CVE-2026-47764
Received Received - Intake

Path Traversal in PDM Package Manager

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. This issue has been fixed in version 2.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-47764
EUVD
EUVD-2026-52854

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pdm_project pdm to 2.27.0 (exc)
pdm_project pdm to 2.22.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the PDM Python package manager affecting versions before 2.27.0. The InstallDestination.write_to_fs() method in src/pdm/installers/installers.py replaces a secure path validation function with an unsafe os.path.join() that allows malicious wheel files with traversal sequences to write arbitrary files outside the intended installation directory.

Detection Guidance

Check installed PDM versions with 'pdm --version'. If using versions prior to 2.27.0, the system is vulnerable. Inspect wheel files for traversal sequences like '../' in their contents.

Impact Analysis

An attacker could exploit this to overwrite critical system files, install malware, or gain unauthorized access by writing files to unintended locations. This could lead to system compromise, data theft, or persistent backdoors if the malicious wheel is installed.

Mitigation Strategies

Upgrade PDM to version 2.27.0 or later using 'pip install --upgrade pdm'. Avoid installing packages from untrusted sources and review installed wheels for suspicious paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47764. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart