CVE-2025-71437

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/astral-sh/uv/security/advisories/GHSA-7j9j-68r2-f35q
https://www.vulncheck.com/advisories/astral-uv-through-0.8.21-path-traversal-via-symlinks-in-sdist-tar-extraction

Configurations

No configuration.

History

28 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Astral uv versiones anteriores a 0.8.22 contiene una vulnerabilidad de salto de ruta en la extracción de tar de la distribución de origen (sdist) que permite que una secuencia especialmente diseñada de enlaces simbólicos redirija escrituras de archivos fuera del prefijo de extracción previsto. Los atacantes pueden publicar un sdist malicioso que, al ser instalado por una víctima, escribe archivos arbitrarios en ubicaciones del sistema de archivos fuera del prefijo de instalación.

21 Oct 2026, 01:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 01:17

Updated : 2026-10-28 14:10

NVD link : CVE-2025-71437

Mitre link : CVE-2025-71437

CVE.ORG link : CVE-2025-71437

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-71437", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71437", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-21T14:40:32.302978Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "astral-sh", "product": "uv", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.8.21"}], "packageURL": "pkg:pypi/uv", "defaultStatus": "unaffected"}]}], "published": "2026-10-21T01:17:19.493", "references": [{"url": "https://github.com/astral-sh/uv/security/advisories/GHSA-7j9j-68r2-f35q", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/astral-uv-through-0.8.21-path-traversal-via-symlinks-in-sdist-tar-extraction", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix."}, {"lang": "es", "value": "Astral uv versiones anteriores a 0.8.22 contiene una vulnerabilidad de salto de ruta en la extracci\u00f3n de tar de la distribuci\u00f3n de origen (sdist) que permite que una secuencia especialmente dise\u00f1ada de enlaces simb\u00f3licos redirija escrituras de archivos fuera del prefijo de extracci\u00f3n previsto. Los atacantes pueden publicar un sdist malicioso que, al ser instalado por una v\u00edctima, escribe archivos arbitrarios en ubicaciones del sistema de archivos fuera del prefijo de instalaci\u00f3n."}], "lastModified": "2026-10-28T14:10:00.220", "sourceIdentifier": "disclosure@vulncheck.com"}