pdm, a Python package and dependency manager, in versions before 2.27.0, writes project-local state or configuration files without protecting against symbolic link (symlink) following. If a malicious repository places these files as symlinks, local pdm operations can overwrite the symlink targets, creating an arbitrary file overwrite primitive relative to the invoking user's privileges. Specifically, Config.__init__() resolves the pdm.toml path and _save_config() writes to the resolved target. If pdm.toml is a symlink, pdm config -l updates the target file instead of refusing the write. Other project-local persistence paths like .pdm-python or .python-version are similarly affected. The vulnerability requires the target file to contain parseable TOML for pdm.toml but not for the other sinks. This issue is addressed in pdm version 2.27.0.

An attacker with local access can exploit this vulnerability to overwrite arbitrary files on the filesystem with the privileges of the user running pdm. This can lead to potential local privilege escalation or disruption of system or user files. The CVSS 4.0 score of 6.8 indicates a medium severity impact with local attack vector and low privileges required but user interaction needed.

This vulnerability has been fixed in pdm version 2.27.0. Users should upgrade to version 2.27.0 or later to remediate this issue. No official patch link is provided, but upgrading to the fixed version is the recommended action. Until upgrading, avoid running pdm commands in untrusted repositories that may contain malicious symlinks.