CVE-2026-29509 describes a path traversal vulnerability in the patool utility prior to version 4.0.5. The vulnerability exists in the safe_extract() function located in patoolib/programs/py_tarfile.py when executed on Python versions before 3.12. The root cause is the use of os.path.commonprefix() in the is_within_directory() helper function, which performs character-level prefix comparison instead of path-level comparison. This incorrect check can be bypassed by an attacker supplying a malicious archive with specially crafted member paths, allowing arbitrary file writes outside the intended extraction directory.

An attacker can craft a malicious archive that, when extracted using vulnerable versions of patool on Python versions before 3.12, can write files to arbitrary locations on the filesystem. This can lead to unauthorized file creation or overwriting, potentially compromising system integrity or security. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and limited confidentiality and integrity impact.

A fix is available in patool version 4.0.5. Users should upgrade to version 4.0.5 or later to remediate this vulnerability. Patch status is not explicitly confirmed beyond the version indication, so users should verify with the vendor or official sources for the latest remediation guidance. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes.