Skip to content
fr Sign in
8.7 High

CVE-2026-114110 Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by…

Description

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.

Affected products and versions

Product Affected versions Fixed in
uv 0.11 earliest → < 0.11.6 0.11.6

References

Timeline

  1. Published
  2. Last modified

Other CVEs of uv

The 6 CVEs of uv →
CVE-2026-114109 uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the… 8.7 High CVE-2025-71437 Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that… 8.7 High CVE-2026-104843 uv is a Python package and project manager written in Rust 5.9 Medium CVE-2025-13327 Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials 6.3 Medium
Track this CVE