CVE-2026-47764 Details
Description
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. This issue has been fixed in version 2.27.0.
A path traversal vulnerability has been identified in pdm, a Python package and dependency manager, in versions through 2.22.4. The issue arises in the InstallDestination.write_to_fs() method, which overrides the base class to support symlinks and hardlinks. However, this implementation replaces a safe path validation method with a basic join operation that lacks proper validation. As a result, a malicious wheel could exploit this flaw to write arbitrary files.
Users can upgrade to pdm version 2.27.0, which addresses this vulnerability. The updated version is available on the pdm project's GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pdm-project/pdm/releases/tag/2.27.0 | [email protected] | Release NotesVendor |
| https://github.com/pdm-project/pdm/security/advisories/GHSA-78v8-vpjp-cjqh | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pdm | <= 2.22.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |