The vulnerability is a path traversal flaw in Poetry's wheel handling. Crafting a wheel with "../" path components allows Poetry to write files outside the intended extraction directory because it does not enforce containment checks. An attacker can overwrite any file that the Poetry process can access, which could lead to tampering with configuration files, injecting malicious scripts, or otherwise compromising the environment. The flaw is flagged as CWE‑22.

Poetry versions from 1.4.0 up to, but not including, 2.3.3 are affected. The issue exists whenever Poetry resolves and installs wheel packages that contain path traversal sequences. Any system running those versions and fetching packages from untrusted or compromised repositories is potentially vulnerable. Updating to 2.3.3 or later removes the containment checks and eliminates the flaw.

The CVSS score of 7.1 classifies the defect as high severity. EPSS information is not available, but the flaw resides in a widely used dependency manager and is publicly known. Because the attack vector relies on an untrusted wheel being introduced during normal install flows, the exploitation probability is moderate to high for environments that do not strictly control package sources. The vulnerability is not listed in CISA’s KEV catalog, but the absence of a patch in earlier versions poses a significant risk until remediation.