Symlink Vulnerability in PDM Python Package and Dependency Manager

CVE-2026-47763

What is CVE-2026-47763?

Versions of PDM prior to 2.27.0 exhibit a serious vulnerability whereby the package manager writes project-local state or configuration files without sufficient symlink protection. This lapse allows a maliciously crafted repository to place symlink files that, when acted upon by PDM during local operations, can lead to unintended overwrites of the original file targets. Specifically, if a valid configuration file path, like pdm.toml, is a symlink, executing commands such as 'pdm config -l' can inadvertently modify the files that the symlink points to, posing risks depending on the permissions granted to the user running the commands. The issue has been effectively addressed in version 2.27.0, ensuring that such symlink traversal cannot occur without additional validation.

References