Log in Start free

Vulnerability · Published Jan 22, 2026 · Assigned by GitHub_M

CVE-2026-24049wheel Allows Arbitrary File Permission Modification via Path Traversal

High 7.1

In plain English

A high-severity path traversal in wheel from pypa. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 71.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10python3-wheel1:0.41.2-5.el10_1.1ALSA-2026:1902
AlmaLinux:10python3-wheel-wheel1:0.41.2-5.el10_1.1ALSA-2026:1902
AlmaLinux:8python3.12-wheel0.41.2-4.el8_10ALSA-2026:2090
AlmaLinux:9python3.12-wheel0.41.2-3.el9_7.1ALSA-2026:1939
AlmaLinux:8python3.12-wheel-wheel0.41.2-4.el8_10ALSA-2026:2090
AlmaLinux:9python3.12-wheel-wheel0.41.2-3.el9_7.1ALSA-2026:1939
Alpine:v3.22py3-wheel0.46.3-r0ALPINE-CVE-2026-24049
Alpine:v3.23py3-wheel0.46.3-r0ALPINE-CVE-2026-24049
Alpine:v3.24py3-wheel0.46.3-r0ALPINE-CVE-2026-24049
Debian:13wheelno fix listedDEBIAN-CVE-2026-24049
Debian:14wheel0.46.3-1DEBIAN-CVE-2026-24049
PyPIwheel0.46.2GHSA-8rrh-rw8j-w5fx
PyPIwheel0.46.2PYSEC-2026-2047
Rocky Linux:10python-wheel1:0.41.2-5.el10_1.1RLSA-2026:1902
Rocky Linux:8python3.12-wheel0:0.41.2-4.el8_10RLSA-2026:2090
Rocky Linux:9python3.12-wheel0:0.41.2-3.el9_7.1RLSA-2026:1939
Ubuntu:25.10python-pipno fix listedUBUNTU-CVE-2026-24049
Ubuntu:25.10wheelno fix listedUBUNTU-CVE-2026-24049

Affected products (as reported)

VendorProductVersions
pypa wheel >= 0.40.0, < 0.46.2

Weakness: CWE-22, CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References