CVE-2026-47764

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe pathwithdestdir() (which validates via Path.resolve() + isrelative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. This issue has been fixed in version 2.27.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47764.json",
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

Git / github.com/pdm-project/pdm

Affected ranges

Type

GIT

Repo

https://github.com/pdm-project/pdm

Events

Introduced

Fixed

09c95b7842844f4e857c88f669e1c666db405c71

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.27.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.0.1

0.0.2

0.0.3

0.0.4

0.0.5

0.0.6

0.1.0

0.1.1

0.1.2

0.10.0

0.10.1

0.10.2

0.11.0

0.12.0

0.12.1

0.12.2

0.12.3

0.2.0

0.2.1

0.2.2

0.2.3

0.2.4

0.2.5

0.2.6

0.3.0

0.3.1

0.3.2

0.4.0

0.4.1

0.4.2

0.5.0

0.6.0

0.6.1

0.6.2

0.6.3

0.6.4

0.6.5

0.7.0

0.7.1

0.8.0

0.8.1

0.8.2

0.8.3

0.8.4

0.8.5

0.8.6

0.8.7

0.9.0

0.9.1

0.9.2

1.*

1.0.0

1.0.0b0

1.0.0b2

1.1.0

1.10.0

1.10.1

1.10.2

1.10.3

1.11.0

1.11.1

1.11.2

1.11.3

1.12.0

1.12.1

1.12.2

1.12.3

1.12.4

1.12.5

1.12.6

1.12.7

1.12.8

1.13.0

1.13.0.post0

1.13.1

1.13.2

1.13.3

1.13.4

1.13.5

1.13.6

1.14.0

1.14.1

1.15.0

1.15.1

1.15.2

1.15.3

1.15.4

1.2.0

1.2.0post1

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.5.0

1.5.0b0

1.5.0b1

1.5.1

1.5.2

1.5.3

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.7.0

1.7.1

1.7.2

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.9.0

2.*

2.0.0

2.0.0a1

2.0.0b1

2.0.0b2

2.0.1

2.0.2

2.0.3

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.10.0

2.10.1

2.10.2

2.10.3

2.10.4

2.11.0

2.11.1

2.11.2

2.12.0

2.12.1

2.12.2

2.12.3

2.12.4

2.13.0

2.13.1

2.13.2

2.13.3

2.14.0

2.15.0

2.15.1

2.15.2

2.15.3

2.15.4

2.16.0

2.16.1

2.17.0

2.17.1

2.17.2

2.17.3

2.18.0

2.18.1

2.18.2

2.19.0

2.19.1

2.19.2

2.19.3

2.2.0

2.2.1

2.20.0

2.20.0.post1

2.20.1

2.21.0

2.22.0

2.22.1

2.22.2

2.22.3

2.22.4

2.23.0

2.23.1

2.24.0

2.24.1

2.24.2

2.25.0

2.25.1

2.25.2

2.25.3

2.25.4

2.25.5

2.25.6

2.25.7

2.25.8

2.25.9

2.26.0

2.26.1

2.26.2

2.26.3

2.26.4

2.26.5

2.26.6

2.26.7

2.26.8

2.26.9

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.6

2.4.7

2.4.8

2.4.9

2.5.0

2.5.0b0

2.5.1

2.5.2

2.5.3

2.6.0

2.6.1

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.8.0

2.8.0a0

2.8.0a1

2.8.0a2

2.8.1

2.8.2

2.9.0

2.9.1

2.9.2

2.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47764.json"