Directory Traversal The advisory has been revoked - it doesn't affect any version of package python-wheel (opens in a new tab)

Threat Intelligence

0.31% (23^rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-CENTOS8-PYTHONWHEEL-15067081
published23 Jan 2026
disclosed22 Jan 2026

Report a new vulnerability Found a mistake?

Introduced: 22 Jan 2026

CVE-2026-24049 (opens in a new tab) CWE-22 (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-wheel package and not the python-wheel package as distributed by Centos.

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.