CVE-2026-47764
- Source
- https://cve.org/CVERecord?id=CVE-2026-47764
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47764.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-47764
- Aliases
- Downstream
DEBIAN (1)
openSUSE (2)
UBUNTU (1)
- Related
- Published
- 2026-08-04T17:57:15Z
- Modified
- 2026-10-26T02:30:23Z
- Severity
-
- 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- pdm: Path traversal in wheel installation via overridden write_to_fs
- Details
-
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. This issue has been fixed in version 2.27.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-22" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47764.json" }- References
Affected packages
Git / github.com/pdm-project/pdm
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pdm-project/pdm
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "2.27.0" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "original_tag": "2.27.0", "range": [ { "fixed": "09c95b7842844f4e857c88f669e1c666db405c71" } ], "source": "REFERENCES_TAG" }, { "range": [ { "introduced": "0" }, { "fixed": "2.27.0" } ], "source": "DESCRIPTION" } ] }
Affected versions
0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.1.0
0.1.1
0.1.2
0.10.0
0.10.1
0.10.2
0.11.0
0.12.0
0.12.1
0.12.2
0.12.3
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.5.0
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.9.0
0.9.1
0.9.2
1.*
1.0.0
1.0.0b0
1.0.0b2
1.1.0
1.10.0
1.10.1
1.10.2
1.10.3
1.11.0
1.11.1
1.11.2
1.11.3
1.12.0
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.13.0
1.13.0.post0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.1
1.15.0
1.15.1
1.15.2
1.15.3
1.15.4
1.2.0
1.2.0post1
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5.0
1.5.0b0
1.5.0b1
1.5.1
1.5.2
1.5.3
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.9.0
2.*
2.0.0
2.0.0a1
2.0.0b1
2.0.0b2
2.0.1
2.0.2
2.0.3
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.11.0
2.11.1
2.11.2
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.1
2.13.2
2.13.3
2.14.0
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.1
2.17.0
2.17.1
2.17.2
2.17.3
2.18.0
2.18.1
2.18.2
2.19.0
2.19.1
2.19.2
2.19.3
2.2.0
2.2.1
2.20.0
2.20.0.post1
2.20.1
2.21.0
2.22.0
2.22.1
2.22.2
2.22.3
2.22.4
2.23.0
2.23.1
2.24.0
2.24.1
2.24.2
2.25.0
2.25.1
2.25.2
2.25.3
2.25.4
2.25.5
2.25.6
2.25.7
2.25.8
2.25.9
2.26.0
2.26.1
2.26.2
2.26.3
2.26.4
2.26.5
2.26.6
2.26.7
2.26.8
2.26.9
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.4.9
2.5.0
2.5.0b0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.8.0
2.8.0a0
2.8.0a1
2.8.0a2
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
2.9.3