AIKIDO-2026-10861
patool is vulnerable to Path Traversal
75
High Risk
This Affects:
patoolTL;DR
Patool's Python tarfile extraction path checks TAR member paths with an unsafe prefix comparison. A crafted TAR archive can use path traversal or sibling-prefix paths to place files and directories outside the requested extraction directory. This can overwrite or create attacker-controlled files when applications extract untrusted TAR archives. The fix resolves both the target path and extraction directory and uses commonpath containment before extracting members.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and extracting TAR archives with the Python tarfile module on Python versions before 3.12.
Background info
patool is vulnerable to Path Traversal in versions 2.4.0 - 4.0.4.
How to fix this
Upgrade the patool library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant