Code Injection Flaw in psd-tools Python Package by Psd-Tools Team
CVE-2026-49836

4.6MEDIUM

Key Information:

Vendor: Psd-tools
Status: Psd-tools
Vendor: CVE Published:; 10 September 2026

What is CVE-2026-49836?

The psd-tools Python package, designed for manipulation of Adobe Photoshop PSD files, contains a vulnerability prior to version 1.17.1. The flaw is rooted in two main functions: SmartObject.save() and SmartObject.open(), where unsanitized, user-controlled inputs allow attackers to determine file paths. An attacker can leverage this to write malicious data to arbitrary locations, including traversing outside the intended directory structure, creating pathways for significant data breaches. The issue is resolved in version 1.17.1, emphasizing the necessity for users to upgrade promptly.