UBUNTU-CVE-2026-49836

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-49836

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-49836.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-49836

Upstream

CVE-2026-49836

Published

2026-09-14T00:00:00Z

Modified

2026-09-14T11:17:26Z

Severity

4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory. A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

References

Affected packages

Ubuntu:24.04:LTS / psd-tools

Package

Name: psd-tools
Purl: pkg:deb/ubuntu/psd-tools?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.9.28+dfsg.1-1

1.9.28+dfsg.1-1build1

1.9.30+dfsg.1-1

1.9.30+dfsg.1-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python3-psd-tools",
            "binary_version": "1.9.30+dfsg.1-1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-49836.json"

Ubuntu:26.04:LTS / psd-tools

Package

Name: psd-tools
Purl: pkg:deb/ubuntu/psd-tools?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.10.7+dfsg.1-1

1.10.7+dfsg.1-1build1

1.10.9+dfsg.1-1

1.12.0+dfsg.1-1

1.12.1+dfsg.1-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python3-psd-tools",
            "binary_version": "1.12.1+dfsg.1-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-49836.json"