CVE-2026-29509 is a path traversal vulnerability in the patool archive extraction utility (wummel patool) affecting versions before 4.0.5. The vulnerability exists in the safe_extract() function located in patoolib/programs/py_tarfile.py when run on Python versions earlier than 3.12. The root cause is the use of os.path.commonprefix() in the is_within_directory() helper function, which performs character-level prefix comparison rather than path-level comparison. This allows an attacker to craft archive member paths that bypass the directory containment check, enabling arbitrary file writes outside the target extraction directory.

An attacker can supply a malicious archive with specially crafted member paths that bypass the safe_extract() directory containment check, potentially writing arbitrary files to locations outside the intended extraction directory. This can lead to unauthorized file creation or overwriting, which may be leveraged for further attacks or system compromise. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and low impact on confidentiality and integrity.

A fix is available in patool version 4.0.5 and later. Users should upgrade to version 4.0.5 or newer to remediate this vulnerability. Since the vulnerability depends on running on Python versions before 3.12, upgrading Python to 3.12 or later may also mitigate the issue. Patch status is not explicitly confirmed in the vendor advisory, so users should verify the availability of the fix in the official patool release notes or repository.