Path Traversal Vulnerability in PDM Dependency Manager
CVE-2026-47764

8.4HIGH

Key Information:

Vendor

Pdm-project

Status
Pdm
Vendor
CVE Published:
4 August 2026

What is CVE-2026-47764?

The PDM dependency manager, supporting Python's latest PEP standards, is susceptible to a path traversal vulnerability in its write_to_fs() functionality. This flaw stems from an unsafe implementation that lacks adequate path validation, which allows a malicious actor to exploit the system by crafting a malicious wheel containing traversal entries. Consequently, this could enable them to write arbitrary files on the host system. The issue has been addressed in version 2.27.0 of PDM.

Affected Version(s)

pdm < 2.27.0

References

https://github.com/pdm-project/pdm/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/pdm-project/pdm/releases/tag/2.27.0
x_refsource_MISC

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.