CVE-2026-47764: PDM Path Traversal Vulnerability

CVE-2026-47764 Overview

CVE-2026-47764 is a path traversal vulnerability in PDM, a Python package and dependency manager that supports the latest PEP standards. Versions prior to 2.27.0 fail to validate file paths when installing wheels, allowing a malicious wheel to write arbitrary files outside the intended installation directory. The flaw resides in InstallDestination.write_to_fs() inside src/pdm/installers/installers.py, which overrides the base class to add symlink and hardlink support but bypasses the safe _path_with_destdir() validation. The maintainers fixed the issue in version 2.27.0.

Critical Impact
A crafted wheel with traversal entries can write arbitrary files anywhere the PDM process has write access, enabling local code execution and configuration tampering.

Affected Products

PDM (Python Development Master) versions prior to 2.27.0
Any Python project using PDM to install untrusted or third-party wheels
CI/CD pipelines invoking PDM against attacker-controlled package sources

Discovery Timeline

2026-08-04 - CVE-2026-47764 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-47764

Vulnerability Analysis

The vulnerability is a classic path traversal flaw [CWE-22] in PDM's wheel installer. PDM's base installer class uses a helper named _path_with_destdir() that resolves paths with Path.resolve() and then verifies the result with is_relative_to() against the destination root. This guarantees that entries such as ../../etc/passwd cannot escape the installation directory.

The subclass InstallDestination.write_to_fs() overrides this behavior to support symlink and hardlink installation modes. In doing so, it replaces the validated path helper with a raw os.path.join() call. os.path.join() performs no traversal validation and happily concatenates parent-directory sequences, meaning any archive entry with ../ components resolves outside the target directory.

A local user or attacker who can influence which wheel PDM installs can therefore write files to arbitrary filesystem locations. Impact ranges from overwriting user startup files and shell configuration to dropping executables into directories on PATH, resulting in code execution under the user running PDM.

Root Cause

The root cause is a security regression introduced by a subclass override. InstallDestination.write_to_fs() intentionally bypasses the safe path construction routine to enable link-based installation, but does not re-implement the Path.resolve() and is_relative_to() boundary check that the base class enforced.

Attack Vector

Exploitation requires the victim to install a malicious wheel with PDM. The attacker publishes a wheel containing archive entries whose names include directory traversal sequences. When PDM installs the wheel, write_to_fs() joins the traversal path with the destination directory using os.path.join() and writes the file to the resolved location outside the project. The vector is local and requires user interaction, since the victim must trigger the install action.

No verified public proof-of-concept is available. See the GitHub Security Advisory GHSA-78v8-vpjp-cjqh for maintainer-provided technical details.

Detection Methods for CVE-2026-47764

Indicators of Compromise

Files written outside the expected virtual environment or site-packages directory during a PDM install, particularly under ~/.ssh/, ~/.bashrc, cron directories, or system PATH locations.
Wheel archives containing entries whose normalized paths include .. segments or absolute paths.
Unexpected symlinks or hardlinks created during dependency resolution that point outside the project tree.

Detection Strategies

Inspect installed wheels statically before use by listing archive members and rejecting any entry whose name contains .. or a leading /.
Pin PDM to version 2.27.0 or later in build images and fail CI if an older version is detected.
Audit endpoint telemetry for pdm install or pdm add processes writing to sensitive paths outside project and cache directories.

Monitoring Recommendations

Log file-write events from Python interpreters spawned by PDM and alert on writes outside project, cache, and virtual environment paths.
Monitor package manager activity in CI/CD runners for wheels sourced from non-approved indexes or mirrors.
Track PDM version strings in build manifests and lockfiles to identify hosts still exposed to CVE-2026-47764.

How to Mitigate CVE-2026-47764

Immediate Actions Required

Upgrade PDM to version 2.27.0 or later on all developer workstations, build servers, and CI/CD runners.
Review recent wheel installations performed by vulnerable PDM versions and validate that no files were written outside intended directories.
Restrict PDM installs to trusted package indexes and enforce hash-pinned lockfiles.

Patch Information

The issue is fixed in PDM 2.27.0. Details are documented in the PDM 2.27.0 Release Notes and the GitHub Security Advisory GHSA-78v8-vpjp-cjqh. The patch reinstates path validation inside InstallDestination.write_to_fs() so that resolved paths must remain relative to the destination directory.

Workarounds

Avoid installing wheels from untrusted or unverified sources until PDM is upgraded.
Run PDM inside an unprivileged, sandboxed user account or container so a successful traversal cannot reach sensitive system paths.
Manually inspect suspect wheels with python -m zipfile -l <wheel> and reject archives whose entries contain traversal sequences.

bash

# Upgrade PDM to the fixed release
pip install --upgrade "pdm>=2.27.0"

# Verify the installed version
pdm --version

# Optional: audit a wheel for traversal entries before installing
python -m zipfile -l ./suspect_package.whl | awk '{print $1}' | grep -E '(^\.\./|/\.\./|^/)'