CVE-2025-71437

Awaiting Analysis Awaiting Analysis - Queue

Astral uv Path Traversal in sdist Extraction

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2025-71437

EUVD

EUVD-2025-211142

Affected Vendors & Products

Vendor	Product	Version / Range
astral-sh	uv	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Astral uv before 0.8.22 has a path traversal flaw in sdist tar extraction. Attackers can create malicious sdist packages with symlinks that write files outside the intended extraction directory during installation. This allows unauthorized filesystem modifications.

Detection Guidance

Check the installed version of uv using the command 'uv --version'. If the version is 0.8.21 or earlier, the system is vulnerable. Review installed Python packages for recently added or modified files outside expected directories, particularly those installed via sdist.

Impact Analysis

If you install a malicious sdist package, it could write arbitrary files to locations outside the installation prefix. This may lead to system compromise, data corruption, or unauthorized access depending on the files targeted.

Compliance Impact

This vulnerability could lead to unauthorized file system modifications, which may result in unauthorized access to sensitive data. This could potentially violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized data exposure or tampering.

Mitigation Strategies

Upgrade uv to version 0.8.22 or later using the command 'uv self update'. Avoid installing Python packages from untrusted sources. Monitor filesystem changes and review package installation logs for suspicious activity.

Hi! I’m here to help you understand CVE-2025-71437. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...