{"id":"CVE-2026-49836","title":"psd-tools: arbitrary file write via smart-object filename","summary":"psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled …","severity":"medium","cvss":4.6,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-22","CWE-73"],"vendor":"psd-tools","product":"psd-tools","affected":["psd-tools < 1.17.1"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-11T17:09:57.762945Z"},"exploitAvailable":true,"published":"2026-09-10","updated":"2026-09-11","sourceUpdated":"2026-09-11T17:13:46.714Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-49836","references":[{"url":"https://github.com/psd-tools/psd-tools/security/advisories/GHSA-2rmg-vrx8-9j2f","label":"https://github.com/psd-tools/psd-tools/security/advisories/GHSA-2rmg-vrx8-9j2f"},{"url":"https://github.com/psd-tools/psd-tools/pull/657","label":"https://github.com/psd-tools/psd-tools/pull/657"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/psd-tools/PYSEC-2026-2969.yaml","label":"https://github.com/pypa/advisory-database/tree/main/vulns/psd-tools/PYSEC-2026-2969.yaml"},{"url":"http://github.com/psd-tools/psd-tools/releases/tag/v1.17.1","label":"http://github.com/psd-tools/psd-tools/releases/tag/v1.17.1"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49836"},{"url":"https://github.com/advisories/GHSA-2rmg-vrx8-9j2f"}],"tags":["cve.org","exploit-available","nvd","ghsa","pip"],"epss":0.00156,"epssPercentile":0.05142,"aliases":["GHSA-2rmg-vrx8-9j2f"],"ecosystem":"pip","patched":["psd-tools 1.17.1"],"ingestedAt":"2026-07-09T23:53:27.215Z","slug":"CVE-2026-49836","body":"## Overview\n\npsd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted `.psd` can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or `../`-traversing), outside its intended output directory. A secondary issue in `SmartObject.open()` for external-kind smart objects allows the attacker-controlled `fullPath` descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.\n\n## Affected\n\n- `psd-tools < 1.17.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49836)\n\nAffected packages:\n\n- `psd-tools <= 1.17.0`\n\nPatched in:\n\n- `psd-tools 1.17.1`\n\nSource: https://github.com/advisories/GHSA-2rmg-vrx8-9j2f","depth":"twilight","depthScore":37,"depthScoreParts":{"impact":25.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":201711,"id":"CVE-2026-49836","ts":1789399642784,"field":"exploit_available","old":"false","new":"true"},{"seq":201710,"id":"CVE-2026-49836","ts":1789399642784,"field":"cvss","old":null,"new":"4.6"},{"seq":200443,"id":"CVE-2026-49836","ts":1789397270090,"field":"exploit_available","old":"true","new":"false"},{"seq":200442,"id":"CVE-2026-49836","ts":1789397270090,"field":"cvss","old":"4.6","new":null},{"seq":198366,"id":"CVE-2026-49836","ts":1789391868151,"field":"exploit_available","old":"false","new":"true"},{"seq":198365,"id":"CVE-2026-49836","ts":1789391868151,"field":"cvss","old":null,"new":"4.6"},{"seq":196158,"id":"CVE-2026-49836","ts":1789383522411,"field":"exploit_available","old":"true","new":"false"},{"seq":196157,"id":"CVE-2026-49836","ts":1789383522411,"field":"cvss","old":"4.6","new":null},{"seq":195087,"id":"CVE-2026-49836","ts":1789380408853,"field":"exploit_available","old":"false","new":"true"},{"seq":195086,"id":"CVE-2026-49836","ts":1789380408853,"field":"cvss","old":null,"new":"4.6"},{"seq":193874,"id":"CVE-2026-49836","ts":1789378389691,"field":"exploit_available","old":"true","new":"false"},{"seq":193873,"id":"CVE-2026-49836","ts":1789378389691,"field":"cvss","old":"4.6","new":null},{"seq":192661,"id":"CVE-2026-49836","ts":1789376353449,"field":"exploit_available","old":"false","new":"true"},{"seq":192660,"id":"CVE-2026-49836","ts":1789376353449,"field":"cvss","old":null,"new":"4.6"},{"seq":191448,"id":"CVE-2026-49836","ts":1789373290507,"field":"exploit_available","old":"true","new":"false"},{"seq":191447,"id":"CVE-2026-49836","ts":1789373290507,"field":"cvss","old":"4.6","new":null},{"seq":190233,"id":"CVE-2026-49836","ts":1789369244522,"field":"exploit_available","old":"false","new":"true"},{"seq":190232,"id":"CVE-2026-49836","ts":1789369244522,"field":"cvss","old":null,"new":"4.6"},{"seq":189020,"id":"CVE-2026-49836","ts":1789368170317,"field":"exploit_available","old":"true","new":"false"},{"seq":189019,"id":"CVE-2026-49836","ts":1789368170317,"field":"cvss","old":"4.6","new":null},{"seq":187803,"id":"CVE-2026-49836","ts":1789365098223,"field":"exploit_available","old":"false","new":"true"},{"seq":187802,"id":"CVE-2026-49836","ts":1789365098223,"field":"cvss","old":null,"new":"4.6"},{"seq":186590,"id":"CVE-2026-49836","ts":1789363155088,"field":"exploit_available","old":"true","new":"false"},{"seq":186589,"id":"CVE-2026-49836","ts":1789363155088,"field":"cvss","old":"4.6","new":null},{"seq":185376,"id":"CVE-2026-49836","ts":1789361052540,"field":"exploit_available","old":"false","new":"true"},{"seq":185375,"id":"CVE-2026-49836","ts":1789361052540,"field":"cvss","old":null,"new":"4.6"},{"seq":184163,"id":"CVE-2026-49836","ts":1789358056467,"field":"exploit_available","old":"true","new":"false"},{"seq":184162,"id":"CVE-2026-49836","ts":1789358056467,"field":"cvss","old":"4.6","new":null},{"seq":182414,"id":"CVE-2026-49836","ts":1789354177749,"field":"exploit_available","old":"false","new":"true"},{"seq":182413,"id":"CVE-2026-49836","ts":1789354177749,"field":"cvss","old":null,"new":"4.6"},{"seq":181207,"id":"CVE-2026-49836","ts":1789353038599,"field":"exploit_available","old":"true","new":"false"},{"seq":181206,"id":"CVE-2026-49836","ts":1789353038599,"field":"cvss","old":"4.6","new":null},{"seq":180000,"id":"CVE-2026-49836","ts":1789350114640,"field":"exploit_available","old":"false","new":"true"},{"seq":179999,"id":"CVE-2026-49836","ts":1789350114640,"field":"cvss","old":null,"new":"4.6"},{"seq":178793,"id":"CVE-2026-49836","ts":1789347993513,"field":"exploit_available","old":"true","new":"false"},{"seq":178792,"id":"CVE-2026-49836","ts":1789347993513,"field":"cvss","old":"4.6","new":null},{"seq":177586,"id":"CVE-2026-49836","ts":1789346239739,"field":"exploit_available","old":"false","new":"true"},{"seq":177585,"id":"CVE-2026-49836","ts":1789346239739,"field":"cvss","old":null,"new":"4.6"},{"seq":176379,"id":"CVE-2026-49836","ts":1789342907836,"field":"exploit_available","old":"true","new":"false"},{"seq":176378,"id":"CVE-2026-49836","ts":1789342907836,"field":"cvss","old":"4.6","new":null},{"seq":175833,"id":"CVE-2026-49836","ts":1789338692106,"field":"exploit_available","old":"false","new":"true"},{"seq":175832,"id":"CVE-2026-49836","ts":1789338692106,"field":"cvss","old":null,"new":"4.6"},{"seq":175703,"id":"CVE-2026-49836","ts":1789338511947,"field":"exploit_available","old":"true","new":"false"},{"seq":175702,"id":"CVE-2026-49836","ts":1789338511947,"field":"cvss","old":"4.6","new":null},{"seq":174498,"id":"CVE-2026-49836","ts":1789334710038,"field":"exploit_available","old":"false","new":"true"},{"seq":174497,"id":"CVE-2026-49836","ts":1789334710038,"field":"cvss","old":null,"new":"4.6"},{"seq":173293,"id":"CVE-2026-49836","ts":1789333391654,"field":"exploit_available","old":"true","new":"false"},{"seq":173292,"id":"CVE-2026-49836","ts":1789333391654,"field":"cvss","old":"4.6","new":null},{"seq":172107,"id":"CVE-2026-49836","ts":1789330954539,"field":"exploit_available","old":"false","new":"true"},{"seq":172106,"id":"CVE-2026-49836","ts":1789330954539,"field":"cvss","old":null,"new":"4.6"}]}