Junglewise Threat Intelligence

CVE-2026-24049: PyPA wheel path traversal in unpack function

CVE-2026-24049 · Severity: high · CVSS 7.1 · Published 2026-01-22

Technologies: Python Packaging Authority (PyPA) Setuptools. Vendors: Python Packaging Authority, PyPI.

Executive brief

The 'wheel' library, a standard tool for installing Python packages, contains a security flaw in how it handles file extractions. An attacker can create a specially crafted package file that, when opened by a user, changes the permissions of sensitive files elsewhere on the computer (such as system configuration or security keys). This could allow an attacker to gain administrative control over the system or modify critical data.

Technical details

A path traversal vulnerability exists in the 'wheel.cli.unpack.unpack' function. While the extraction process itself (via zipfile) is sanitized, the subsequent 'chmod' operation blindly trusts the unsanitized filename from the archive header (zinfo.filename). By crafting a wheel file containing entries with '../' sequences and specific external attributes, an attacker can trigger a chmod operation on files outside the intended destination directory. This can be used to make sensitive files like /etc/passwd or SSH keys world-writable (0o777). The issue is also present in 'setuptools' due to its vendoring of the 'wheel' library. A fix is available in version 0.46.2 which uses the sanitized path returned by the extraction process for permission updates.

Affected products

  • Python Packaging Authority (PyPA) wheel 0.40.0 through 0.46.1
  • Python Packaging Authority (PyPA) setuptools Affected via vendored wheel library

Timeline

  • 2026-01-21: patched: Version 0.46.2 released
  • 2026-01-22: disclosed: Security advisory published

References

Related threats