CVE-2026-49836

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49836
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49836.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49836
Aliases
Downstream
Published
2026-09-10T21:47:57Z
Modified
2026-09-18T03:46:53Z
Severity
  • 4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
psd-tools: arbitrary file write via smart-object filename
Details

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory. A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49836.json"
}
References

Affected packages

Git / github.com/psd-tools/psd-tools

Affected ranges

Type
GIT
Repo
https://github.com/psd-tools/psd-tools
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
634aaf4bd6fd70e94cbe325b22b88211d38c690d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.17.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1
0.1.1
0.1.2
0.1.3
0.1.4
0.10
0.2
0.5
0.6
0.7
0.7.1
0.8
0.8.1
0.8.2
0.8.3
0.8.4
0.9
0.9.1
1.*
1.0
1.1
1.2
1.3
1.4
1.8.10
1.8.11
1.8.12
1.8.14
1.8.17
1.8.21
1.8.25
1.8.26
1.8.8
1.8.9
v.*
v.1.9.0
v1.*
v1.10.0
v1.10.1
v1.10.10
v1.10.11
v1.10.12
v1.10.13
v1.10.2
v1.10.3
v1.10.4
v1.10.5
v1.10.6
v1.10.7
v1.10.8
v1.10.9
v1.11.0
v1.11.1
v1.12.0
v1.12.1
v1.13.1
v1.14.0
v1.14.1
v1.14.2
v1.14.3
v1.15.0
v1.15.0.post1
v1.16.0
v1.17.0
v1.8.26
v1.8.27
v1.8.28
v1.8.29
v1.8.30
v1.8.31
v1.8.32
v1.8.33
v1.8.34
v1.8.35
v1.8.36
v1.8.37.post1
v1.8.37.post2
v1.8.37.post3
v1.8.38
v1.9.1
v1.9.10
v1.9.11
v1.9.12
v1.9.13
v1.9.14
v1.9.15
v1.9.16
v1.9.17
v1.9.18
v1.9.19
v1.9.2
v1.9.20
v1.9.21
v1.9.22
v1.9.23
v1.9.24
v1.9.25
v1.9.26
v1.9.27
v1.9.28
v1.9.29
v1.9.3
v1.9.30
v1.9.31
v1.9.32
v1.9.33
v1.9.34
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v1.9.8
v1.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49836.json"