Threat database

patool versions prior to 4.0.6 on Windows contain an OS command injection vulnerability due to improper escaping of cmd.exe metacharacters and embedded double quotes in archive filenames. This allows attackers to craft malicious filenames that can execute arbitrary commands with the privileges of the patool process when single-file formats are run with shell=True.

Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12, where the is_within_directory() helper uses os.path.commonprefix() for character-level string comparison instead of path-level comparison, allowing a crafted archive member path to bypass the containment check. Attackers can supply a malicious archive with specially crafted member paths to write arbitrary files.