psd-tools has 2 CVEs on record. 1 was published in the last 90 days. The median CVSS is 4.6 (medium).

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 0% vs 1% corpus
Median CVSS: 4.6
Publish → KEV: —
Last 90 days: 1 prev 0

Weakness classes

Products

psd-tools 2

Follow psd-tools:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

CVE-2026-49836Medium· 4.6psd-tools: arbitrary file write via smart-object filename37
CVE-2026-27809Mediumpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps28

psd-tools vulnerabilities

CVEs affecting psd-tools, newest first. Open any entry for full detail, references, and exploit status.

2 CVEsRSS

CVE-2026-49836Medium· 4.6PoC

1w ago

psd-tools: arbitrary file write via smart-object filename

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled …

▾ Twilightpsd-tools · psd-toolsEPSS 0.16%via CVEORG

CVE-2026-27809Medium

6mo ago

psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps

▾ Sunlitpsd-tools · psd-toolsEPSS 0.41%via OSV