CVE-2026-29509 Details
Description
Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12, where the is_within_directory() helper uses os.path.commonprefix() for character-level string comparison instead of path-level comparison, allowing a crafted archive member path to bypass the containment check. Attackers can supply a malicious archive with specially crafted member paths to write arbitrary files.
A path traversal vulnerability has been identified in Patool versions prior to 4.0.5. The issue arises in the safe_extract() function within the py_tarfile.py module, when the software is run on Python versions prior to 3.12. The vulnerability occurs because the is_within_directory() helper function uses character-level string comparison, allowing a crafted archive member path to bypass containment checks. This flaw enables attackers to manipulate archive member paths to write arbitrary files.
Users can upgrade to Patool version 4.0.5 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wummel/patool/blob/main/doc/changelog.txt | [email protected] | Release NotesVendor |
| https://github.com/wummel/patool/releases/tag/4.0.5 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/patool-path-traversal-via-safe-extract-function | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Patool | < 4.0.5 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 27, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |