Is there a patch available for CVE-2026-29509?

Yes, a patch is available for CVE-2026-29509. Update the affected software to the latest version immediately.

Patool CVE-2026-29509

Q: What is the CVSS score of CVE-2026-29509?

CVE-2026-29509 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39879 MEDIUM

Path Traversal (CWE-22)

2026-06-26 VulnCheck

GHSA-p95f-9f9h-wwvh

Python Path Traversal Red Hat Patool

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Archive delivered over network (AV:N), no complexity barrier (AC:L), no attacker privileges needed (PR:N), user must extract archive (UI:R), arbitrary file write gives high integrity impact (I:H), no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 26, 2026 - 20:32 vuln.today

Analysis Generated

Jun 26, 2026 - 20:32 vuln.today

DescriptionCVE.org

Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12, where the is_within_directory() helper uses os.path.commonprefix() for character-level string comparison instead of path-level comparison, allowing a crafted archive member path to bypass the containment check. Attackers can supply a malicious archive with specially crafted member paths to write arbitrary files.

AnalysisAI

Path traversal in Patool's safe_extract() function allows an attacker-controlled archive to write files to arbitrary locations on the filesystem when extracted by a victim running Patool before 4.0.5 on Python before 3.12. The flaw exists because the is_within_directory() helper in patoolib/programs/py_tarfile.py uses os.path.commonprefix() for character-level string prefix matching rather than path-component-level comparison, making it trivially bypassable with crafted member paths. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity exploitation conditions and complete integrity bypass make this a meaningful risk for affected deployments.

Technical ContextAI

Patool (CPE: cpe:2.3:a:wummel:patool) is a Python-based universal archive command-line tool. The vulnerability (CWE-22: Path Traversal) is rooted in a subtle but well-known pitfall of os.path.commonprefix(): it operates character-by-character rather than path-segment-by-segment. For example, the paths '/extract/output' and '/extract/output2/../../../etc/cron.d/' share a character-level common prefix of '/extract/output', causing the containment check to incorrectly conclude the second path is within the first. Python 3.12 addressed zip/tarfile path traversal systematically at the stdlib level, which is why the vulnerability is conditional on Python < 3.12. The affected code path is specifically in patoolib/programs/py_tarfile.py, making it triggered only when Patool processes tar-format archives via the Python tarfile backend.

RemediationAI

The primary fix is to upgrade Patool to version 4.0.5, the vendor-released patch available at https://github.com/wummel/patool/releases/tag/4.0.5 and documented in https://github.com/wummel/patool/blob/main/doc/changelog.txt. If an immediate upgrade is not possible, upgrading the Python runtime to 3.12 or later mitigates the vulnerability at the stdlib level since Python 3.12 enforces path safety in tarfile extraction, though this may have compatibility implications for other dependencies and should be tested in staging first. As a compensating control, restrict Patool usage to trusted archive sources only and avoid processing archives from untrusted or user-supplied inputs until patched. Do not use Patool to extract archives in privileged directories or as a privileged user, as the blast radius of arbitrary file write scales directly with the privileges of the extracting process.