Summary
It was discovered that wheel did not correctly handle certain file paths.
If a user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to execute arbitrary code.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | wheel | 0.42.0-2ubuntu0.1~esm1 |
Vulnerabilities 1
-
High 7.1CVE-2026-24049 Public exploit
wheel Allows Arbitrary File Permission Modification via Path Traversal
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic b…
References
-
report
https://ubuntu.com/security/CVE-2026-24049