CVE-2026-47764
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
pdm is a Python package and dependency manager. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files.
Risk Assessment
The risk is the ability to write arbitrary files on the system via a malicious package, potentially leading to system compromise or modification of critical files.
Recommendation
It is recommended to upgrade pdm to version 2.27.0 or higher, which includes a fix for this vulnerability.
Other vulnerabilities in pdm
See all- CVE-2026-47781High
PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. This happens because load_plugins() runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and immediately executes any line beginning with import, so the code runs with the privileges of the user invoking pdm and even a benign command such as pdm --version triggers it (making the impact strongest in CI, automation, and privileged contexts).
- CVE-2026-47763Medium
pdm, a Python package and dependency manager, prior to version 2.27.0 writes several project-local state or configuration files without symlink protection. A malicious repository can place those files as symlinks, and local PDM operations can overwrite the symlink targets, creating an arbitrary file clobber primitive relative to the invoking user's privileges.
Original NVD description (English source)
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. This issue has been fixed in version 2.27.0.