p PatchFirst

CVE-2025-71437

CVE-2025-71437 · Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.

CVSS 8.7 · High · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • uv

    Versions
    • ≥ 0, ≤ 0.8.21: Affected (semver)

    No fix published

  • uv Ubuntu:26.10

    Versions
    • 0.9.17+ds1-3
    • 0.9.17+ds1-4
    • 0.9.17+ds1-5
    • 0.9.17+ds1-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →