AIKIDO-2026-975498

TL;DR

The SmartObject.save() method in psd-tools writes an embedded smart object to a file path taken verbatim from the parsed PSD without sanitization. When an application extracts embedded smart objects from an untrusted PSD, the embedded name can contain an absolute path or ../ traversal sequences, causing file-supplied bytes to be written outside the intended output directory. For external-kind smart objects, the fullPath descriptor is additionally used as an arbitrary read source, so file contents can be copied into the output directory. The fix strips directory components from the embedded name, confines writes to a caller-supplied directory, and constrains external read paths.