Skip to content
fr Sign in
8.7 High

CVE-2025-71437 Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that…

Description

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.

Affected products and versions

Product Affected versions Fixed in
uv 0.8 earliest → 0.8.21 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of uv

The 6 CVEs of uv →
CVE-2026-114110 Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by… 8.7 High CVE-2026-114109 uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the… 8.7 High CVE-2026-104843 uv is a Python package and project manager written in Rust 5.9 Medium CVE-2025-13327 Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials 6.3 Medium
Track this CVE