PDM wheel installation leads to Path Traversal via overridden write_to_fs

InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe pathwithdestdir which validates via Path.resolve + isrelativeto with a bare os.path.join that performs no path validation. A malicious wheel with travers...

CVE-2026-34591 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa...

CVE-2026-34591 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, request-1276...

5gasp-cli (>=0.1.0, <=0.4.0), aia-read-svc (>=0.5.1, <=0.6.2) +390 more potentially affected by CVE-2026-34591 via poetry (>=1.4.0, <=2.3.2)

poetry PYPI version =1.4.0, =0.1.0, =0.5.1, =2023.2.21, =0.2.0rc3, =0.1.0, =0.1.1, =0.6.0.68, =0.0.1, =0.1.0rc7, =0.0.2, =0.0.3 and more Source cves: CVE-2026-34591 Source advisory: SNYK:PYTHON-POETRY-15873752...