p PatchFirst

CVE-2026-34591

CVE-2026-34591 · Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.

CVSS 7.1 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • poetry

    Versions
    • >= 1.4.0, < 2.3.3: Affected

    No fix published

  • poetry Debian:12

    Versions
    • 1.3.2+dfsg-3
    • 1.3.2+dfsg-4
    • 1.3.2+dfsg-5
    • 1.5.1+dfsg-1
    • 1.5.1+dfsg-2
    • 1.5.1+dfsg-3
    • 1.5.1+dfsg-4
    • 1.6.1+dfsg-1
    • 1.6.1+dfsg-2
    • 1.7.1+dfsg-1
    • 1.8.0.dev0~git20240220.cff4d7d5+dfsg-1
    • 1.8.0.dev0~git20240220.cff4d7d5+dfsg-2
    • 1.8.2+dfsg-1
    • 1.8.3+dfsg-1
    • 1.8.3+dfsg-2
    • 1.8.3+dfsg-3
    • 1.8.3+dfsg-4
    • 2.0.1+dfsg-1
    • 2.1.1+dfsg-1
    • 2.1.1+dfsg-2
    • 2.1.1+dfsg-3
    • 2.1.2+dfsg-1
    • 2.2.1+dfsg-1
    • 2.2.1+dfsg-2
    • 2.2.1+dfsg-3
    • 2.3.2+dfsg-1
    • 2.3.2+dfsg-2
    • 2.3.2+dfsg-3
    • 2.3.4-0.1
    • 2.3.4-1
    • 2.3.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry Debian:13

    Versions
    • 2.1.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 2.1.2+dfsg-1+deb13u1

    Update to 2.1.2+dfsg-1+deb13u1

  • poetry Debian:14

    Versions
    • 2.1.2+dfsg-1
    • 2.2.1+dfsg-1
    • 2.2.1+dfsg-2
    • 2.2.1+dfsg-3
    • 2.3.2+dfsg-1
    • 2.3.2+dfsg-2
    • 2.3.2+dfsg-3
    Affected ranges
    • ECOSYSTEM: < 2.3.4-0.1

    Update to 2.3.4-0.1

  • poetry PyPI

    Versions
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 1.6.1
    • 1.7.0
    • 1.7.1
    • 1.8.0
    • 1.8.1
    • 1.8.2
    • 1.8.3
    • 1.8.4
    • 1.8.5
    • 2.0.0
    • 2.0.1
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    • 2.3.2
    Affected ranges
    • ECOSYSTEM: ≥ 1.4.0, < 2.3.3

    Update to 2.3.3

  • poetry Ubuntu:22.04:LTS

    Versions
    • 1.1.11+dfsg-3
    • 1.1.12+dfsg-1
    • 1.1.12+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry Ubuntu:24.04:LTS

    Versions
    • 1.6.1+dfsg-2
    • 1.7.1+dfsg-1
    • 1.8.2+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry Ubuntu:25.10

    Versions
    • 2.1.1+dfsg-3
    • 2.1.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry Ubuntu:26.10

    Versions
    • 2.3.2+dfsg-3
    • 2.3.4-0.1
    • 2.3.4-1
    • 2.3.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry Ubuntu:26.04:LTS

    Versions
    • 2.1.2+dfsg-1
    • 2.3.2+dfsg-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →