CVE-2026-29509

MediumCVSS 5.4

Published: 26/06/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

Patool before version 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12. The vulnerability arises because the is_within_directory() helper uses os.path.commonprefix() for character-level string comparison instead of path-level comparison, allowing a crafted archive member path to bypass the containment check.

Risk Assessment

An attacker can supply a malicious archive with specially crafted member paths to write arbitrary files on the victim's system, potentially leading to system compromise or privilege escalation.

Recommendation

Immediately update Patool to version 4.0.5 or later and ensure Python 3.12 or later is used to mitigate this vulnerability.

Other vulnerabilities in Patool

CVE-2026-106057High
patool before version 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execute commands with patool process privileges.

Original NVD description (English source)

Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12, where the is_within_directory() helper uses os.path.commonprefix() for character-level string comparison instead of path-level comparison, allowing a crafted archive member path to bypass the containment check. Attackers can supply a malicious archive with specially crafted member paths to write arbitrary files.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS