PT-2026-23610 · Unknown · Dbt-Common

Sethmlarson · Published 2026-03-05 · Updated 2026-03-13 · CVE-2026-29790

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions dbt-common versions prior to 1.34.2 dbt-common versions prior to 1.37.3

Description A path traversal issue exists in the safe extract() function of dbt-common when extracting tarball archives. The function uses os.path.commonprefix() to validate file paths, but this function compares paths character-by-character instead of by path components. This allows a malicious tarball to write files to sibling directories with matching name prefixes. For example, when extracting to /tmp/packages, a crafted tarball could write files to /tmp/packagesevil/. The vulnerability affects users who install dbt packages from untrusted sources or process tarball archives through dbt-common's extraction utilities. The fix replaces os.path.commonprefix() with os.path.commonpath(), which correctly compares paths by their components.

Recommendations Upgrade to dbt-common version 1.34.2 or later. Upgrade to dbt-common version 1.37.3 or later. Only install dbt packages from trusted sources. Avoid installing packages from untrusted URLs or unverified third parties. Review package contents before installation when sourcing from external locations.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-29790

GHSA-W75W-9QV4-J5XJ

Affected Products

Dbt-Common

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29790.json · Exploit
• https://github.com/dbt-labs/dbt-common/security/advisories/GHSA-w75w-9qv4-j5xj · Vendor Advisory
• https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709 · Patch
• https://osv.dev/vulnerability/CVE-2026-29790 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w75w-9qv4-j5xj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29790 · Security Note
• https://github.com/pypa/pip/pull/13777 · Note
• https://github.com/dbt-labs/dbt-common · Note
• https://docs.python.org/3/library/os.path.html#os.path.commonpath · Note
• https://t.me/CVEtracker/46643 · Telegram Post
• https://t.me/cveNotify/155461 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2030132443756335596 · Twitter Post
• https://twitter.com/CVEnew/status/2030385162203148441 · Twitter Post
• https://github.com/advisories/GHSA-6vgw-5pg2-w6jp · Note