CVE-2026-49836

Name of the Vulnerable Software and Affected Versions psd-tools versions prior to 1.17.1

Description An issue exists where the SmartObject.save() function writes embedded smart objects to a path taken directly from a PSD file without sanitization. This allows an attacker to use absolute paths or directory traversal sequences (e.g., ../) to write arbitrary bytes to an unintended location on the system. Additionally, for external-kind smart objects, the SmartObject.open() function can be manipulated using a fullPath descriptor to read arbitrary files from the system and write their contents to the attacker-controlled destination. This path traversal occurs because the software fails to properly limit the pathname to a restricted directory.

Recommendations Update to version 1.17.1. As a temporary mitigation, restrict the use of the SmartObject.save() and SmartObject.open() functions when processing untrusted PSD or PSB files.