boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-24049

CVE-2026-24049MEDIUM
pypa wheel — wheel Allows Arbitrary File Permission Modification via Path Traversal
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  N  H  N    5.5   .0036   27.0     —
AFFECTED
  Product  Versions               Fixed
  wheel    >= 0.40.0, < 0.46.2 –  —
TIMELINE
  Jan 20  Reserved by GitHub_M
  Jan 22  Published (CNA: GitHub_M)
  Aug 24  EXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
  Aug 24  RESCORED — CVE-2026-24049 (pypa wheel). CVSS 7.1 → 5.5 (NVD).
  Aug 26  EXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
  Sep 1   EXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
  Sep 2   EXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
  Sep 7   EXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
  Sep 9   EXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
  Sep 10  EXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
CWE-22, CWE-732 · CNA: GitHub_M · CVSS v3.1 · 50 references · NVD status: Modified

Description

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.

Lifecycle

Complete event history — 10 events, chronological
DateEventDetail
January 20, 2026ReservedReserved by GitHub_M
January 22, 2026PublishedPublished (CNA: GitHub_M)
August 24, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
August 24, 2026RESCOREDRESCORED — CVE-2026-24049 (pypa wheel). CVSS 7.1 → 5.5 (NVD).
August 26, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
September 1, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
September 2, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
September 7, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
September 9, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.
September 10, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
pypawheel—>= 0.40.0, < 0.46.2—

Weaknesses

CWE-22 · CWE-732

References (50)

Related

Authoritative record: CVE-2026-24049 at cve.org

Vendors: pypa

Weaknesses: CWE-22 · CWE-732

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-24049 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.