CVE-2026-29509
Description
Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12, where the is_within_directory() helper uses os.path.commonprefix() for character-level string comparison instead of path-level comparison, allowing a crafted archive member path to bypass the containment check. Attackers can supply a malicious archive with specially crafted member paths to write arbitrary files.
Summary dbcve.org
Patool before 4.0.5 has a path traversal vulnerability in safe_extract() where is_within_directory() uses os.path.commonprefix() for character-level string comparison instead of proper path-level comparison. This allows malicious archive entries with crafted paths like 'evil/../file.txt' to bypass containment checks and write files outside the intended extraction directory.
Mitigation
Upgrade patool to version 4.0.5 or later, which implements proper path-level comparison in the containment check. If upgrading is not immediately possible, validate and sanitize all archive member paths before extraction.