The vulnerability arises because pdm versions before 2.27.0 write project-local configuration and state files without checking for symlinks, allowing an attacker who controls a malicious repository to place symlinks that pdm will follow and overwrite the symlink targets. Specifically, Config.__init__() resolves the pdm.toml path and _save_config() writes to the resolved target file. If pdm.toml is a symlink, pdm config -l updates the target file instead of refusing the write. Other project-local persistence files like .pdm-python and .python-version are similarly affected but without the TOML parsing constraint. This creates an arbitrary file clobber primitive with the privileges of the invoking user. The issue is tracked as CWE-61 (Improper Resolution of Symbolic Links) and has been fixed in version 2.27.0.

An attacker who can supply a malicious repository with crafted symlinks can cause pdm to overwrite arbitrary files on the local filesystem with the privileges of the user running pdm. This can lead to local privilege escalation or corruption of important files. The vulnerability requires local access or the ability to influence the repository content used by pdm. The CVSS 4.0 score is 6.8 (medium severity), reflecting local attack vector, low attack complexity, no privileges required, but user interaction needed and high impact on integrity.

Upgrade pdm to version 2.27.0 or later, where this symlink following issue has been fixed. Until then, avoid using pdm with untrusted repositories that could contain malicious symlinks. There is no official patch link provided, but the vendor has fixed the issue in version 2.27.0. Patch status is confirmed by the vendor advisory stating the fix is in 2.27.0.