Executive brief
psd-tools is a Python library used to read and manipulate Adobe Photoshop files. A vulnerability in how it handles 'smart objects' allows a malicious PSD file to write files to arbitrary locations on a user's computer or server when the file is processed. This could allow an attacker to overwrite system files or configuration, potentially leading to full system takeover or data theft.
Technical details
The vulnerability exists in the SmartObject.save() and SmartObject.open() methods of psd-tools. In SmartObject.save(), the 'filename' attribute is taken directly from the PSD file's linked-layer metadata without sanitization, allowing for absolute paths or directory traversal (e.g., '../../'). This enables an arbitrary file write (CWE-22) of attacker-controlled bytes. Additionally, for 'external' kind smart objects, the SmartObject.open() method uses an unsanitized 'fullPath' descriptor, which can be exploited to read arbitrary files from the local filesystem and subsequently write them to an attacker-accessible location. The issue is fixed in version 1.17.1 by implementing path validation using os.path.basename() and verifying that resolved paths remain within the intended output directory.
Affected products
- psd-tools psd-tools <= 1.17.0
Timeline
- 2026-06-02: disclosed: Initial disclosure on GitHub
- 2026-07-09: advisory: GitHub Advisory published
- 2026-07-09: patched: Fixed in version 1.17.1