Most recent entries from all

CVE-2026-24049 — wheel Allows Arbitrary File Permission Modification via Path Traversal

Affected: pypa wheel, Red Hat Discovery 2 for RHEL 10, Red Hat Discovery 2 for RHEL 8, Red Hat Discovery 2 for RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8 and 50 more

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.

GHSA-8rrh-rw8j-w5fx — Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

Affected: PyPI: wheel

### Summary - **Vulnerability Type:** Path Traversal (CWE-22) leading to Arbitrary File Permission Modification. - **Root Cause Component:** wheel.cli.unpack.unpack function. - **Affected Packages:** 1. wheel (Upstream source) 2. setuptools (Downstream, vendors wheel) - **Severity:** High (Allows modifying system file permissions).

### Details The vulnerability exists in how the unpack function handles file permissions after extraction. The code blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. ``` # Vulnerable Code Snippet (present in both wheel and setuptools/_vendor/wheel) for zinfo in wf.filelist: wf.extract(zinfo, destination) # (1) Extraction is handled safely by zipfile

# (2) VULNERABILITY: # The 'permissions' are applied to a path constructed using the UNSANITIZED 'zinfo.filename'. # If zinfo.filename contains "../", this targets files outside the destination. permissions = zinfo.external_attr >> 16 & 0o777 destination.joinpath(zinfo.filename).chmod(permissions) ```

### PoC I have confirmed this exploit works against the unpack function imported from setuptools._vendor.wheel.cli.unpack.

**Prerequisites:** pip install setuptools

**Step 1: Generate the Malicious Wheel (gen_poc.py)** This script creates a wheel that passes internal hash validation but contains a directory traversal payload in the file list.…

PYSEC-2026-2047 — Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

Affected: PyPI: wheel

### PoC I have confirmed this exploit works against the unpack function imported from setuptools._vendor.wheel.cli.unpack.

**Prerequisites:** pip install setuptools

**Step 1: Generate the Malicious Wheel (gen_poc.py)** This script creates a wheel that passes internal hash validation but contains a directory traversal payload in the file list.…