PT-2026-48601 · Pypi · Pdm

Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-47764

OSV

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

InstallDestination.write to fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe path with destdir() (which validates via Path.resolve() + is relative to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. Same class as Poetry CVE-2026-34591. Fix ready at: https://github.com/pdm-project/pdm/pull/3787.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-47764

GHSA-78V8-VPJP-CJQH

Affected Products

Pdm

References · 5

• https://osv.dev/vulnerability/GHSA-78v8-vpjp-cjqh · Vendor Advisory
• https://github.com/pdm-project/pdm · Note
• https://github.com/pdm-project/pdm/releases/tag/2.27.0 · Note
• https://github.com/pdm-project/pdm/pull/3787 · Note
• https://github.com/pdm-project/pdm/security/advisories/GHSA-78v8-vpjp-cjqh · Note