CVE-2026-49836: psd-tools Arbitrary File Write and Read Vulnerability via Smart-Object Filename
Summary
CVE-2026-49836: psd-tools vulnerable to arbitrary file write via smart-object filename. Affects psd-tools versions < 1.17.1. Fixed in 1.17.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
psd-tools is an open-source Python library designed for reading and writing Adobe Photoshop PSD files. It provides a user-friendly API for manipulating PSD files, including support for layers, smart objects, and other features inherent to the PSD format. The library is widely used in applications that require PSD file handling, making it crucial for developers to ensure its security and integrity.
Vulnerability Detail
The vulnerability in psd-tools arises from the SmartObject.save() method, which allows an attacker to write files to arbitrary locations on the filesystem by exploiting an unsanitized filename derived from the PSD file. This can lead to unauthorized file writes, potentially overwriting critical files or executing malicious code. Additionally, the SmartObject.open() method permits attackers to read arbitrary files from the filesystem, further exacerbating the risk of data exfiltration. The vulnerability is present in all versions up to 1.17.0 and is fixed in version 1.17.1.
How To Fix
Latest published version: 1.26.0 as of 23 Oct 2026
pip install --upgrade "psd-tools==1.26.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.17.1
This is the first release that contains the fix.
pip install --upgrade "psd-tools==1.17.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider implementing file path validation in your application to ensure that any filenames derived from PSD files do not contain directory traversal characters (e.g., '..'). This can help mitigate the risk until the package is updated.
Conclusion
The psd-tools library has a significant vulnerability that can lead to arbitrary file writes and reads, posing a risk to applications that process untrusted PSD files. It is crucial to update to the patched version and implement additional security measures to protect against potential exploits.
See every vulnerability recorded for psd-tools →
FAQ
CVE-2026-49836 is a vulnerability in the psd-tools library that allows arbitrary file write and read operations through unsanitized smart-object filenames.
If your application uses psd-tools to process untrusted PSD files, it may be exploited to write files to arbitrary locations or read sensitive files from the filesystem.
All versions of psd-tools up to and including 1.17.0 are affected by this vulnerability.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
Update the psd-tools package to version 1.17.1 or later using pip install --upgrade psd-tools. Additionally, implement file path validation in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for psd-tools.
