CVE-2026-47764

Name of the Vulnerable Software and Affected Versions pdm versions prior to 2.28.0

Description The write to fs() function in the InstallDestination class fails to properly validate file paths when adding symlink or hardlink support. It replaces the secure path with destdir() method, which uses Path.resolve() and is relative to() for validation, with os.path.join(). This lack of validation allows a malicious wheel package containing path traversal entries to write arbitrary files to the system.

Recommendations Update to version 2.28.0 or later.