CVE-2026-49836: Psd-Tools

Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days.

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted `.psd` can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or `../`-traversing), outside its intended output directory. A secondary issue in `SmartObject.open()` for external-kind smart objects allows the attacker-controlled `fullPath` descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Affected products

• Psd-Tools Psd-Tools: before 1.17.1 (fixed in 1.17.1)

Published 2026-09-10. Last modified 2026-09-30.