CVE-2026-47764 pdm-project CVE debrief

Who should care

Users of pdm versions prior to 2.27.0 should be aware of the potential path traversal vulnerability and take steps to mitigate it. Organizations using pdm should review their current version, assess their exposure, and plan for upgrades or mitigations as necessary. Security teams should monitor for suspicious activity and review file system writes to detect potential exploitation attempts.

Technical summary

The pdm package and dependency manager is vulnerable to path traversal through write_to_fs in versions prior to 2.27.0. A malicious wheel with traversal entries can write arbitrary files. This issue has been fixed in version 2.27.0, which includes a safe _path_with_destdir() that validates via Path.resolve() + is_relative_to(). Users of affected versions should prioritize upgrading to mitigate potential path traversal attacks.

Defensive priority

Organizations using pdm versions prior to 2.27.0 should prioritize upgrading to mitigate potential path traversal attacks.

Recommended defensive actions

• Upgrade pdm to version 2.27.0 or later
• Review and validate file system writes
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record indicates that pdm versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. The issue has been fixed in version 2.27.0. Users should verify their current version and ensure they have the latest updates installed. Additionally, defenders should review the file system writes and monitor for suspicious activity.

Official resources