PDM writes project‑local state and configuration files without protecting against symlink traversal. In affected releases before 2.27.0, the program resolves paths such as pdm.toml, .pdm‑python, or .python‑version and writes directly to the resolved target without checking whether the path is a symbolic link. This flaw allows an attacker to produce a repository that contains symlinks pointing to arbitrary files; when PDM performs a state write during normal operation, it will follow the link and overwrite the target file, thereby clobbering that file with user‑supplied data. The root cause is a path‑traversal weakness (CWE‑61) that manifests as arbitrary file clobbering at the user’s privilege level.

PDM, version 2.26.x and earlier, is affected by this vulnerability. All installations using a release older than 2.27.0 lack symlink protection during configuration writes and therefore are susceptible. The issue is resolved in release 2.27.0 and later.

The CVSS score of 6.8 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious repository that contains at least one symlink to a target file that the attacker can modify. The attacker typically obtains the repository or injects it into an existing one; then any routine PDM command that triggers a state write (for example, pdm config -l …) will cause the overwrite. The impact remains local to the user account running PDM; however, overwriting key project files such as configuration or interpreter selection can disrupt builds, break dependencies, or in extreme cases cause deceptive behavior if the overwritten file is executed. The attack vector is inferred from the description rather than explicitly stated in the CVE entry. Because the flaw requires local write access to the target file and only operates within the project directory, a system‑wide compromise would be unlikely without additional privileges.