Relative Path Traversal Affecting safecmd package, versions [,0.1.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Relative Path Traversal vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-SAFECMD-15202485
- published4 Feb 2026
- disclosed1 Feb 2026
- creditUnknown
Introduced: 1 Feb 2026
CVE NOT AVAILABLE CWE-23 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade safecmd to version 0.1.1 or higher.
Overview
safecmd is a Call commands safely by checking them rigorously against an allow-list
Affected versions of this package are vulnerable to Relative Path Traversal via the extract_commands() function that lacks proper validation of relative paths. An unauthenticated attacker could gain access to files and directories outside the intended scope bypassing allowlist matching.