CVE-2026-47764: 
Python vulnerability analysis and mitigation

CVE-2026-47764 is a path traversal vulnerability in PDM (Python package and dependency manager) that allows a malicious wheel package to write arbitrary files outside the intended installation directory. It affects PDM versions up to and including 2.22.4, and was fixed in version 2.27.0. The vulnerability was first published on May 21, 2026, and added to the GitHub Advisory Database on June 10, 2026. It carries a CVSS v4.0 base score of 8.4 (High) per Feedly/ENISA data, and 7.1 (High) per the GitHub Advisory Database (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerable function InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class implementation to add symlink and hardlink support, but in doing so replaces the safe _path_with_destdir() method — which validates paths using Path.resolve() combined with is_relative_to() — with a bare os.path.join() call that performs no path validation whatsoever. An attacker can craft a malicious wheel file containing path traversal entries (e.g., ../../) that, when installed via PDM, causes files to be written to arbitrary locations on the filesystem. This vulnerability is in the same class as Poetry CVE-2026-34591, which exploited a similar path traversal weakness in wheel installation (GitHub Advisory, PDM Security Advisory).

Successful exploitation allows an attacker to write arbitrary files to any location accessible by the user running PDM, bypassing the intended installation directory restrictions. This can lead to high confidentiality and integrity impacts — for example, overwriting configuration files, SSH authorized keys, shell profiles, or other sensitive files to achieve persistent access or privilege escalation. Availability is also impacted, as critical system or application files could be overwritten or corrupted. The attack requires user interaction (installing a malicious package), but no privileges are required from the attacker's side (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report. The NVD SSVC assessment indicates exploitation is currently "none," though it notes the technical impact is "total" and the vulnerability is automatable. The EPSS score is approximately 0.047–0.148%, placing it in a low percentile for near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a victim to install a specially crafted malicious wheel package using a vulnerable version of PDM (GitHub Advisory, Feedly).

1. Craft a malicious wheel: Create a Python wheel (.whl) file containing file entries with path traversal sequences in their filenames (e.g., ../../../../home/user/.ssh/authorized_keys) pointing to a target file outside the installation directory.
2. Host or distribute the wheel: Publish the malicious wheel to a package index (e.g., a private or typosquatted PyPI package), or distribute it directly to the target.
3. Induce the victim to install: Social-engineer or otherwise cause a developer using PDM <= 2.22.4 to install the malicious package via pdm add <package> or pdm install.
4. Trigger path traversal: When PDM processes the wheel, InstallDestination.write_to_fs() calls os.path.join() without validating the resolved path, allowing the traversal entries to resolve outside the scheme directory.
5. Achieve arbitrary file write: The malicious file content is written to the attacker-specified path (e.g., overwriting ~/.bashrc, ~/.ssh/authorized_keys, or a cron job file), potentially enabling persistent access or privilege escalation (GitHub Advisory, PDM Security Advisory).

• File System: Unexpected or modified files in directories outside the Python package installation path (e.g., ~/.ssh/, ~/.bashrc, /etc/cron.d/, /tmp/) with timestamps coinciding with a pdm install or pdm add operation; new or altered symlinks in the project or home directory.
• Logs: PDM installation logs showing wheel extraction of files with ../ or unusual absolute path components; system audit logs (e.g., auditd) recording file writes to sensitive directories by the PDM process.
• Process: Unexpected child processes or shell activity following a pdm command execution; pdm process writing files outside the virtual environment or project directory as observed via strace or similar tools.
• Network: Outbound connections from the developer's machine to unknown hosts shortly after package installation, which may indicate a post-exploitation payload delivered via the malicious wheel.

The primary remediation is to upgrade PDM to version 2.27.0 or later, which fixes the vulnerability by restoring proper path validation in the installer (PDM Release). The fix disallows installing files to paths outside the scheme directory and also refuses to write project-local config files when the destination is a symlink. No official configuration-based workaround is available for users who cannot upgrade immediately; as a precaution, users should avoid installing packages from untrusted or unverified sources and review wheel contents before installation using tools like unzip -l <package>.whl.

The vulnerability was noted as being in the same class as Poetry CVE-2026-34591, highlighting a broader pattern of path traversal issues in Python package manager wheel installers. OpenSUSE issued security announcements covering the PDM update as part of broader package security updates (OpenSUSE Announce). A dev.to article discussed AI agents being used to fix real security bugs including this class of vulnerability. Red Hat tracked the issue via Bugzilla and assigned it high severity (Red Hat Bugzilla). Overall community reaction has been measured, with the fix being straightforward and no significant controversy or widespread alarm noted.