Executive Summary

CVE-2026-29509 is a path traversal vulnerability in the safe_extract() function of the patool library versions before 4.0.5, specifically when running on Python versions prior to 3.12.

The vulnerability occurs because the is_within_directory() helper function uses os.path.commonprefix() for character-level string comparison instead of proper path-level comparison. This flaw allows attackers to craft malicious archive member paths that bypass the containment check.

As a result, an attacker can supply a specially crafted archive that, when extracted, writes arbitrary files outside the intended extraction directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to write arbitrary files to the system by extracting a malicious archive.

Such unauthorized file creation can lead to potential system compromise, including overwriting critical files, placing malicious executables, or altering system configurations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the extraction of malicious TAR archives that contain crafted member paths bypassing directory containment checks. Detection can focus on monitoring for suspicious archive extraction activities or scanning extracted files for unexpected file paths outside intended directories.

You can check if your system uses a vulnerable version of patool (before 4.0.5) running on Python versions prior to 3.12.

Suggested commands to detect potential exploitation or presence of malicious files include:

• Verify patool version: `patool --version` or check installed package version via `pip show patool`.
• Check Python version: `python3 --version` to confirm if it is below 3.12.
• Search for files created outside expected extraction directories after archive extraction, for example using `find /path/to/extract -type f ! -path '/path/to/extract/*'` to detect files outside the target directory.
• Monitor system logs or audit logs for unexpected file writes or archive extraction commands.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade patool to version 4.0.5 or later, which contains a security patch addressing this vulnerability.

Additionally, ensure that your Python environment is updated to version 3.12 or later, as the vulnerability specifically affects Python versions before 3.12.

Avoid extracting TAR archives from untrusted or unauthenticated sources until the patch is applied.

Implement monitoring for suspicious archive extraction activities and restrict permissions on directories used for extraction to limit potential damage.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to write arbitrary files outside the intended extraction directory, which can lead to unauthorized file creation or system compromise.

Such unauthorized file access and potential system compromise could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.

However, the provided information does not explicitly describe the direct effects on compliance with these standards.

Useful 0 Not Useful 0