CyberRota Analysis
AI-GeneratedVersions of the pdm package prior to 2.27.0 are vulnerable to a path traversal attack due to inadequate validation in the InstallDestination.write_to_fs() method, allowing malicious wheels to write arbitrary files to the filesystem. This vulnerability poses a significant risk, as it can lead to unauthorized file creation and potential system compromise. Organizations using pdm for Python package management should prioritize upgrading to version 2.27.0 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. This issue has been fixed in version 2.27.0.