CVE-2026-34591: Poetry Arbitrary File Write Vulnerability Due to Wheel Path Traversal
Summary
CVE-2026-34591: Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write. Affects poetry versions >= 1.4.0, < 2.3.3. Fixed in 2.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Poetry is a popular dependency management tool for Python that simplifies the process of managing project dependencies, packaging, and publishing. It allows developers to specify their dependencies in a straightforward manner and handles the installation and resolution of these packages. However, a recent vulnerability has been identified that can lead to arbitrary file writes when handling crafted wheel files, posing a significant risk to users and CI/CD systems.
Vulnerability Detail
The vulnerability arises from the way Poetry processes wheel files. Specifically, it fails to enforce containment checks on paths that contain '..' sequences, allowing an attacker to craft a malicious wheel file that can write files outside the intended directory. This can lead to unauthorized file modifications or creations with the same privileges as the Poetry process, potentially compromising the system. The vulnerable code is located in the wheel_installer.py and executor.py files, where the destination path is constructed without proper validation.
How To Fix
Latest published version: 2.5.1 as of 23 Oct 2026
pip install --upgrade "poetry==2.5.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.3
This is the first release that contains the fix.
pip install --upgrade "poetry==2.3.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid installing untrusted or unknown wheel files until they can update to the patched version. Additionally, users can implement file system permissions to restrict write access to sensitive directories.
Conclusion
In summary, the CVE-2026-34591 vulnerability in Poetry allows for arbitrary file writes due to improper handling of wheel file paths. Users are strongly encouraged to update to version 2.3.3 or newer to mitigate this risk. Until then, exercise caution when dealing with untrusted packages.
See every vulnerability recorded for poetry →
FAQ
The impact includes the potential for arbitrary file writes, which can lead to unauthorized access or modifications of files on the system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
Versions of Poetry prior to 2.3.3 are affected by this vulnerability. Users should upgrade to 2.3.3 or newer.
If you cannot update immediately, avoid installing untrusted wheel files and consider implementing stricter file system permissions.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for poetry.
