Fixed security issue around wheel unpack (#675)

A maliciously crafted wheel could cause the permissions of a file outside the unpack tree to be altered.

Fixes CVE-2026-24049.

Author: agronholm

docs/news.rst

@@ -7,6 +7,8 @@ Release Notes
   v70.1
 - Importing ``wheel.bdist_wheel`` now emits a ``FutureWarning`` instead of a
   ``DeprecationWarning``
+- Fixed ``wheel unpack`` potentially altering the permissions of files outside of the
+  destination tree with maliciously crafted wheels (CVE-2026-24049)
 
 **0.46.1 (2025-04-08)**
 

src/wheel/_commands/unpack.py

@@ -19,12 +19,12 @@ def unpack(path: str, dest: str = ".") -> None:
         destination = Path(dest) / namever
         print(f"Unpacking to: {destination}...", end="", flush=True)
         for zinfo in wf.filelist:
-            wf.extract(zinfo, destination)
+            target_path = Path(wf.extract(zinfo, destination))
 
             # Set permissions to the same values as they were set in the archive
             # We have to do this manually due to
             # https://github.com/python/cpython/issues/59999
             permissions = zinfo.external_attr >> 16 & 0o777
-            destination.joinpath(zinfo.filename).chmod(permissions)
+            target_path.chmod(permissions)
 
     print("OK")

tests/commands/test_unpack.py

@@ -54,3 +54,26 @@ def test_unpack_executable_bit(tmp_path: Path) -> None:
     run_command("unpack", "--dest", tmp_path, wheel_path)
     assert not script_path.is_dir()
     assert stat.S_IMODE(script_path.stat().st_mode) == 0o755
+
+
+@pytest.mark.skipif(
+    platform.system() == "Windows", reason="Windows does not support chmod()"
+)
+def test_chmod_outside_unpack_tree(tmp_path_factory: TempPathFactory) -> None:
+    wheel_path = tmp_path_factory.mktemp("build") / "test-1.0-py3-none-any.whl"
+    with WheelFile(wheel_path, "w") as wf:
+        wf.writestr(
+            "test-1.0.dist-info/METADATA",
+            "Metadata-Version: 2.4\nName: test\nVersion: 1.0\n",
+        )
+        wf.writestr("../../system-file", b"malicious data")
+
+    extract_root_path = tmp_path_factory.mktemp("extract")
+    system_file = extract_root_path / "system-file"
+    extract_path = extract_root_path / "subdir"
+    system_file.write_bytes(b"important data")
+    system_file.chmod(0o755)
+    run_command("unpack", "--dest", extract_path, wheel_path)
+
+    assert system_file.read_bytes() == b"important data"
+    assert stat.S_IMODE(system_file.stat().st_mode) == 0o755