CVE-2025-71437
CVE-2025-71437 · Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.
CVSS 8.7 · Hoch · EPSS 0,3%
- Veröffentlicht
- Aktualisiert
Technologie-Stack: system