dbt-common's commonprefix() doesn't protect against path traversal

The core of the vulnerability lies in the os.path.commonprefix() function used by safeextract(). Instead of comparing path components, it compares paths character-by-character. This allows a carefully crafted tarball to include file paths that, while sharing a common prefix with the intended destination directory (e.g., /tmp/packages), ultimately write files to sibling directories. For instance, a malicious tarball could write files to /tmp/pac/maliciousfile.txt despite the intended extraction path being /tmp/packages. This could lead to arbitrary file writes, potentially overwriting critical system files or injecting malicious code, depending on the permissions of the user running the dbt process.

Organizations using dbt-common in their data transformation pipelines are at risk, particularly those who accept tarball archives from untrusted sources. Shared hosting environments where multiple users have access to the dbt environment are also at increased risk, as a compromised user could potentially exploit this vulnerability to affect other users.

• python / dbt: Inspect dbt-common version using python -c "import dbtcommon; print(dbtcommon.version)". If the version is ≤1.9.0, the system is vulnerable. • python / dbt: Monitor dbt logs for any unusual file creation activity within the extraction directory (e.g., /tmp/packages). • generic web: If dbt is exposed via a web interface, monitor access logs for requests containing suspicious file paths in the tarball archive URL.

1. 2026-03-05Disclosure

   disclosure

1. Réservé2026-03-04
2. Publiée2026-03-05
3. Modifiée2026-03-06
4. EPSS mis à jour2026-03-23

The primary mitigation is to upgrade dbt-common to version 1.34.2 or later, which contains the fix for this vulnerability. If an immediate upgrade is not feasible due to compatibility concerns or breaking changes, consider restricting the source of tarball archives to trusted locations. Implement strict file permission controls on the extraction directory to limit the potential impact of a successful exploit. Review and audit any custom extraction logic to ensure robust path validation. After upgrading, verify the fix by attempting to extract a known malicious tarball (if available) and confirming that files are not written outside the intended destination directory.