DEBIAN-CVE-2026-49836

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-49836
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-49836.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-49836
Upstream
Published
2026-09-10T22:16:57Z
Modified
2026-09-12T08:47:26Z
Severity
  • 4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory. A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

References

Affected packages

Debian:12 / psd-tools

Package

Name
psd-tools
Purl
pkg:deb/debian/psd-tools?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.9.24+dfsg.1-1
1.9.28+dfsg.1-1
1.9.30+dfsg.1-1
1.9.31+dfsg.1-1
1.9.32+dfsg.1-1
1.9.34+dfsg.1-1
1.10.7+dfsg.1-1
1.10.9+dfsg.1-1
1.12.0+dfsg.1-1
1.12.1+dfsg.1-1
1.14.2+dfsg.1-1
1.14.3+dfsg.1-1
1.15.0+dfsg.1-1
1.16.0+dfsg.1-1
1.17.0+dfsg.1-1
1.17.4+dfsg.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-49836.json"

Debian:13 / psd-tools

Package

Name
psd-tools
Purl
pkg:deb/debian/psd-tools?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.10.7+dfsg.1-1
1.10.7+dfsg.1-1+deb13u1
1.10.9+dfsg.1-1
1.12.0+dfsg.1-1
1.12.1+dfsg.1-1
1.14.2+dfsg.1-1
1.14.3+dfsg.1-1
1.15.0+dfsg.1-1
1.16.0+dfsg.1-1
1.17.0+dfsg.1-1
1.17.4+dfsg.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-49836.json"

Debian:14 / psd-tools

Package

Name
psd-tools
Purl
pkg:deb/debian/psd-tools?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.17.4+dfsg.1-1

Affected versions

1.*
1.10.7+dfsg.1-1
1.10.9+dfsg.1-1
1.12.0+dfsg.1-1
1.12.1+dfsg.1-1
1.14.2+dfsg.1-1
1.14.3+dfsg.1-1
1.15.0+dfsg.1-1
1.16.0+dfsg.1-1
1.17.0+dfsg.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-49836.json"