Read the docs
TI-2026-23327 Aliases CVE-2026-29509GHSA-p95f-9f9h-wwvh

Patool < 4.0.5 Path Traversal via safe_extract() Function

Priority LOW 24CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12, where the is_within_directory() helper uses os.path.commonprefix() for character-level string comparison instead of path-level comparison, allowing a crafted archive member path to bypass the containment check. Attackers can supply a malicious archive with specially crafted member paths to write arbitrary files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00371 31st percentileScored 2026-11-07
Fix Fixed patool (wummel): 4.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wummelpatoolbefore 4.0.54.0.5Patch availableCNA
  • patool Vendorwummel Affected before 4.0.5 Fixed in 4.0.5 Patch available CNA

Remediation

  • Fix · CNA patool (wummel) Fixed in 4.0.5

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29509
  2. 2026-10-03 Alias added: GHSA-p95f-9f9h-wwvh

References

Patch 1

Other 1

  • TI-2026-69114 OS command injection in patool on Windows via archive filenames CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences