CVE-2026-49836: psd-tools path traversal in SmartObject.save and SmartObject.open

CVE-2026-49836 · Severity: medium · CVSS 4 · Published 2026-09-10

psd-tools is a Python library used to read and manipulate Adobe Photoshop files. A vulnerability in how it handles 'smart objects' allows a malicious PSD file to write files to arbitrary locations on a user's computer or server when the file is processed. This could allow an attacker to overwrite system files or configuration, potentially leading to full system takeover or data theft.

Technologies: psd-tools (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-49836 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49836 being exploited in the wild.
How severe is CVE-2026-49836?
Medium severity, with a CVSS score of 4, published 10 September 2026.
Which products and versions are affected?
psd-tools (PyPI) <= 1.17.0, ECOSYSTEM:introduced=0,fixed=1.17.1.
Is there a fix for CVE-2026-49836?
Yes. psd-tools (PyPI): upgrade to 1.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49836 attacked?
It is attacked with local access or over the network, in a software library.
Am I affected by CVE-2026-49836?
Check whether you run psd-tools (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • psd-tools (PyPI): upgrade to 1.17.1 or later
    pip install "psd-tools>=1.17.1"

Technical details

The vulnerability exists in the SmartObject.save() and SmartObject.open() methods of psd-tools. In SmartObject.save(), the 'filename' attribute is taken directly from the PSD file's linked-layer metadata without sanitization, allowing for absolute paths or directory traversal (e.g., '../../'). This enables an arbitrary file write (CWE-22) of attacker-controlled bytes. Additionally, for 'external' kind smart objects, the SmartObject.open() method uses an unsanitized 'fullPath' descriptor, which can be exploited to read arbitrary files from the local filesystem and subsequently write them to an attacker-accessible location. The issue is fixed in version 1.17.1 by implementing path validation using os.path.basename() and verifying that resolved paths remain within the intended output directory.

Affected products

  • psd-tools psd-tools <= 1.17.0

Identifiers

  • CVE-2026-49836
  • GHSA-2rmg-vrx8-9j2f
  • PYSEC-2026-2969

Timeline

  • 2026-06-02: disclosed: Initial disclosure on GitHub
  • 2026-07-09: advisory: GitHub Advisory published
  • 2026-07-09: patched: Fixed in version 1.17.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.