CVE-2026-49836

NameCVE-2026-49836
Descriptionpsd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted `.psd` can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or `../`-traversing), outside its intended output directory. A secondary issue in `SmartObject.open()` for external-kind smart objects allows the attacker-controlled `fullPath` descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
psd-tools (PTS)bookworm1.9.24+dfsg.1-1vulnerable
trixie1.10.7+dfsg.1-1+deb13u1vulnerable
forky, sid1.17.4+dfsg.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
psd-toolssource(unstable)1.17.4+dfsg.1-1

Notes

https://github.com/psd-tools/psd-tools/security/advisories/GHSA-2rmg-vrx8-9j2f
https://github.com/psd-tools/psd-tools/pull/657 (v1.17.1)

Search for package or bug name: Reporting problems