CVE-2026-24049 wheel Allows Arbitrary File Permission Modification via Path Traversal
Attackers can exploit path traversal in the wheel unpack function to modify permissions of critical system files, leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-24049?
CVE-2026-24049 is a high-severity path traversal vulnerability in pypa wheel, published on 22 Jan 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.
Which versions are affected by CVE-2026-24049?
3 open source packages ship an affected version, including wheel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wheel PyPI | From 0.40.0 | 0.46.2 |
wheel PyPI | From 0.40.0 | 0.46.2 |
wheel PyPI | From 0.40.0 | 0.46.2 |
Linux distribution packages (37)
python3-wheel AlmaLinux:10 | All versions | 1:0.41.2-5.el10_1.1 |
python3-wheel-wheel AlmaLinux:10 | All versions | 1:0.41.2-5.el10_1.1 |
python3.12-wheel AlmaLinux:8 | All versions | 0.41.2-4.el8_10 |
python3.12-wheel-wheel AlmaLinux:8 | All versions | 0.41.2-4.el8_10 |
python3.12-wheel AlmaLinux:9 | All versions | 0.41.2-3.el9_7.1 |
python3.12-wheel-wheel AlmaLinux:9 | All versions | 0.41.2-3.el9_7.1 |
discovery-cli Red Hat:discovery:2::el10 | All versions | 0:2.4.3-2.el10 |
discovery-cli Red Hat:discovery:2::el8 | All versions | 0:2.4.3-2.el8 |
discovery-cli Red Hat:discovery:2::el9 | All versions | 0:2.4.3-2.el9 |
python-wheel Red Hat:enterprise_linux:10.1 | All versions | 1:0.41.2-5.el10_1.1 |
python3-wheel Red Hat:enterprise_linux:10.1 | All versions | 1:0.41.2-5.el10_1.1 |
python3-wheel-wheel Red Hat:enterprise_linux:10.1 | All versions | 1:0.41.2-5.el10_1.1 |
python3.12-wheel Red Hat:enterprise_linux:8::appstream | All versions | 0:0.41.2-4.el8_10 |
python3.12-wheel-wheel Red Hat:enterprise_linux:8::crb | All versions | 0:0.41.2-4.el8_10 |
python3.12-wheel Red Hat:enterprise_linux:9::appstream | All versions | 0:0.41.2-3.el9_7.1 |
python3.12-wheel-wheel Red Hat:enterprise_linux:9::crb | All versions | 0:0.41.2-3.el9_7.1 |
python-wheel Red Hat:enterprise_linux_eus:10.0 | All versions | 1:0.41.2-5.el10_0.1 |
python3-wheel Red Hat:enterprise_linux_eus:10.0 | All versions | 1:0.41.2-5.el10_0.1 |
python3-wheel-wheel Red Hat:enterprise_linux_eus:10.0 | All versions | 1:0.41.2-5.el10_0.1 |
python3.12-wheel Red Hat:rhel_eus:9.4::appstream | All versions | 0:0.41.2-3.el9_4.1 |
python3.12-wheel-wheel Red Hat:rhel_eus:9.4::crb | All versions | 0:0.41.2-3.el9_4.1 |
python3.12-wheel Red Hat:rhel_eus:9.6::appstream | All versions | 0:0.41.2-3.el9_6.1 |
python3.12-wheel-wheel Red Hat:rhel_eus:9.6::crb | All versions | 0:0.41.2-3.el9_6.1 |
python-wheel Rocky Linux:10 | All versions | 1:0.41.2-5.el10_1.1 |
python3.12-wheel Rocky Linux:8 | All versions | 0:0.41.2-4.el8_10 |
python3.12-wheel Rocky Linux:9 | All versions | 0:0.41.2-3.el9_7.1 |
python-wheel SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 0.40.0-150400.13.10.1 |
python-wheel SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 0.40.0-150400.13.10.1 |
python-wheel SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 0.40.0-150400.13.10.1 |
python-wheel SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 0.40.0-150400.13.10.1 |
python-wheel SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 0.40.0-150400.13.10.1 |
python-wheel SUSE:Linux Enterprise Module for Python 3 15 SP7 | All versions | 0.42.0-150600.3.3.1 |
python313-wheel SUSE:Linux Enterprise Module for Python 3 15 SP7 | All versions | 0.44.0-150700.3.3.1 |
python-wheel SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 0.40.0-150400.13.10.1 |
python-wheel SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 0.40.0-150400.13.10.1 |
python-wheel SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 0.42.0-150600.3.3.1 |
python-wheel SUSE:Linux Enterprise Server 16.0 | All versions | 0.45.1-160000.3.1 |
Products include Wheel Project Wheel.
How do I fix CVE-2026-24049?
Upgrade wheel to 0.46.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-24049 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24049 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in pypa wheel
Sources
Also known as ALPINE-CVE-2026-24049, ALSA-2026:1902, ALSA-2026:1939, ALSA-2026:2090, AZL-75192, AZL-75195 and 44 more.