Quick answers
- Is CVE-2026-47764 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-47764 being exploited in the wild.
- How severe is CVE-2026-47764?
- High severity, with a CVSS score of 4, published 4 August 2026.
- Which products and versions are affected?
- pdm (PyPI) <= 2.22.4, ECOSYSTEM:introduced=0,fixed=2.27.0.
- Is there a fix for CVE-2026-47764?
- Yes. pdm (PyPI): upgrade to 2.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-47764 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-47764?
- Check whether you run pdm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- pdm (PyPI): upgrade to 2.27.0 or later
pip install "pdm>=2.27.0"
Technical details
A path traversal vulnerability exists in PDM's installer due to an insecure override of the `InstallDestination.write_to_fs()` method in `src/pdm/installers/installers.py`. The implementation replaces the secure `_path_with_destdir()` validation (which uses `Path.resolve()` and `is_relative_to()`) with a bare `os.path.join()` call that lacks path validation. An attacker can exploit this by distributing a malicious Python wheel containing file paths with traversal sequences (e.g., `../../`). When a user installs the package, PDM will write files to arbitrary locations on the filesystem. The issue is addressed in version 2.27.0.
Affected products
- pdm-project pdm <= 2.22.4
Identifiers
- CVE-2026-47764
- GHSA-78v8-vpjp-cjqh
- PYSEC-2026-2861
Timeline
- 2026-05-21: disclosed
- 2026-05-21: patched: Fixed in version 2.27.0
- 2026-06-10: advisory