CVE-2026-49836 Details
Description
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted `.psd` can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or `../`-traversing), outside its intended output directory. A secondary issue in `SmartObject.open()` for external-kind smart objects allows the attacker-controlled `fullPath` descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.
A path traversal vulnerability has been identified in the psd-tools Python package, specifically in versions through 1.17.0. The issue arises in the SmartObject API, where the save() method writes embedded smart objects to a path taken directly from the PSD file without proper sanitization. This allows an attacker to manipulate the filename to write arbitrary data to a chosen location, potentially outside the intended output directory. Additionally, for external-kind smart objects, the open() method can be exploited to read arbitrary files and exfiltrate their contents to a controlled write destination. Both issues have been addressed in version 1.17.1.
Users can upgrade to psd-tools version 1.17.1 or later, where this vulnerability has been fixed. Instructions for updating the package are available on the Python Package Index (PyPI).
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/psd-tools/psd-tools/security/advisories/GHSA-2rmg-vrx8-9j2f | CISA-ADP | AdvisoryExploitRemedyVendor |
| http://github.com/psd-tools/psd-tools/releases/tag/v1.17.1 | [email protected] | Release NotesVendor |
| https://github.com/psd-tools/psd-tools/pull/657 | [email protected] | Issue TrackingVendor |
| https://github.com/psd-tools/psd-tools/security/advisories/GHSA-2rmg-vrx8-9j2f | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/pypa/advisory-database/tree/main/vulns/psd-tools/PYSEC-2026-2969.yaml | [email protected] | AdvisoryBundleExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| psd-tools | <= 1.17.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | [email protected] |