The vulnerability arises from pdm’s InstallDestination.write_to_fs method replacing secure path validation with a basic join operation, allowing a wheel that contains path traversal entries to write files arbitrarily. This omission enables an attacker to place files anywhere on the filesystem during a wheel install, potentially overwriting critical binaries or dropping malicious code. The weakness is a classic path traversal flaw (CWE‑22) that can lead to full system compromise if exploited.

The product affected is the pdm package manager from pdm‑project. All versions prior to 2.27.0 are vulnerable. No other vendors or versions are listed as impacted.

The CVSS score of 8.4 classifies the issue as high severity. EPSS information is not provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation data. However, the flaw can be leveraged whenever an attacker can supply a malicious wheel for installation, making the attack vector likely local or based on the trust model of the package source. The lack of path checks means the exploit does not require additional privileges, so any user able to run pdm install could potentially affect the host.