Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a classic symlink following issue (CWE-61), where the application writes to configuration or state files within a project directory without first verifying that these files are not symbolic links. An attacker can prepare a malicious project repository containing symlinks that point to sensitive files on the victim's system (e.g., ~/.bashrc, ~/.ssh/config).
When the victim runs a standard PDM command (like pdm config or pdm use) within this repository, the tool follows the symlink and overwrites the target file. This provides an arbitrary file-clobber primitive, allowing modification of files outside the project directory with the privileges of the user running PDM.
The analysis of the security advisory and the patch commits confirms multiple vulnerable functions. The patch for pdm.toml handling in src/pdm/project/config.py clearly shows the vulnerability pattern: path.resolve() was used to determine the file path, and the write function _save_config lacked a symlink check. The advisory correctly identified other sinks (.pdm-python, .python-version) and the corresponding functions (Project.use_python, UseCommand.handle) that followed the same vulnerable pattern of writing to a file path without symlink validation. The remediation across all identified functions was to stop resolving symlinks and add explicit checks to prevent writing to them.
pdm.project.config.Config.__init__src/pdm/project/config.py
pdm.project.config.Config._save_configsrc/pdm/project/config.py
pdm.project.core.Project.use_pythonsrc/pdm/project/core.py
pdm.cli.commands.use.UseCommand.handlesrc/pdm/cli/commands/use.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pdm | pip | < 2.27.0 | 2.27.0 |
Expected result:
pdm.toml is a symlink to another TOML filepdm config -l venv.in_project false modifies the symlink targetObserved output from local validation:
--- target ---
[seed]
value = 1
[venv]
in_project = false
Medium
6.8 (Medium)CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:NRationale:
AV:L: exploitation requires local execution of pdm against an attacker-prepared checkoutAC:L: there is no complex constraint once the symlink sink existsAT:N: no extra prerequisite beyond the victim running the relevant command is requiredPR:N: the attacker does not need prior privileges on the victim systemUI:A: the victim must actively run a command that writes project-local state or configVC:N: the demonstrated issue is a write primitive, not a direct read primitiveVI:H: the attacker can cause unauthorized modification of files outside the repository rootVA:L: file clobber can disrupt local operation, but direct same-step availability impact is lower than a full RCESC:N/SI:N/SA:N: the base score is limited to the directly affected systemProject-local file sinks are treated as trusted regular files and are written without symlink checks or guarded atomic replacement.
lstat and O_NOFOLLOW where availableThis issue is independent from the code-execution issues above. It is best tracked as a separate CVE candidate because the root cause and remediation are different.