python-poetry, a Python dependency manager, versions 1.4.0 through before 2.3.3 are vulnerable to a path traversal vulnerability (CWE-22) identified as CVE-2026-34591. A maliciously crafted wheel package can include '../' sequences in file paths, which Poetry writes to disk without proper containment checks. This allows an attacker to write arbitrary files anywhere the Poetry process has write permissions during normal install flows from untrusted package artifacts. While installation alone does not execute malicious code, subsequent import or invocation of the malicious package by the user can lead to code execution. The vulnerability has been addressed in Poetry version 2.3.3.

An attacker can write arbitrary files to the filesystem with the privileges of the Poetry process by supplying a malicious wheel package during installation. This can lead to unauthorized file modification or creation. However, code execution requires user action to import or run the malicious package after installation. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1.

Upgrade python-poetry to version 2.3.3 or later, where this path traversal vulnerability has been patched. Users should avoid installing packages from untrusted sources until they have applied the update.