CVE-2026-47763
Received Received - Intake

Symlink Arbitrary File Write in Pdm

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets. This creates an arbitrary file clobber primitive relative to the privileges of the invoking user. Config.__init__() resolves the project-local pdm.toml path and _save_config() writes to the resolved target. If PROJECT_ROOT/pdm.toml is a symlink to another file, pdm config -l ... updates the target file instead of refusing the write. The same general problem exists for other project-local persistence paths that are written directly with no lstat / O_NOFOLLOW protection. For the pdm.toml PoC specifically, the target file must already contain parseable TOML. Otherwise the load step fails before the write path is reached. That parser constraint does not apply to the .pdm-python or .python-version sinks. This issue has been fixed in version 2.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-47763
EUVD
EUVD-2026-52807

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pdm_project pdm to 2.27.0 (exc)
pdm_project pdm 2.26.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects PDM, a Python package and dependency manager, in versions before 2.27.0. It involves PDM writing project-local files without checking for symlinks. If a malicious repository contains these files as symlinks, PDM operations can overwrite the symlink targets, allowing arbitrary file modification within the user's privileges.

Detection Guidance

Check for symlinked PDM configuration files like pdm.toml, .pdm-python, or .python-version in project directories. Use commands like 'find /path/to/project -type l -name "pdm.toml" -o -name ".pdm-python" -o -name ".python-version"' to locate suspicious symlinks.

Impact Analysis

An attacker could exploit this to overwrite important files on your system, such as configuration files or scripts, by tricking you into running PDM commands in a malicious repository. This could disrupt operations or enable further attacks if the overwritten files are executed with elevated privileges.

Mitigation Strategies

Upgrade PDM to version 2.27.0 or later using 'pip install --upgrade pdm'. Avoid running PDM commands in untrusted repositories. Review project directories for unexpected symlinks in PDM files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47763. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart