CVE-2026-114110

Received Received - Intake

Path Traversal in Astral uv Package

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulnCheck

Description

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114110

EUVD

EUVD-2026-106913

Affected Vendors & Products

Vendor	Product	Version / Range
astral-sh	uv	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal flaw in Astral uv versions before 0.11.6. It allows attackers to delete arbitrary files by including relative path traversal sequences in RECORD entries of malicious wheels. When a user uninstalls such a package, uv may delete files outside the intended installation directory due to improper path validation.

Detection Guidance

Check installed uv versions with 'uv --version' and compare against 0.11.6. Inspect RECORD files in installed wheels for relative path traversal sequences like '../'. Monitor file deletion logs during package uninstallation for unexpected paths.

Impact Analysis

This vulnerability can lead to data loss or system compromise if you install and later uninstall a maliciously crafted wheel. Attackers could target and delete critical files outside the package installation directory, potentially disrupting system operations or causing permanent damage.

Compliance Impact

This vulnerability could lead to unauthorized file deletion, potentially causing data loss or exposure of sensitive information. For GDPR, this may violate principles of data integrity and confidentiality (Article 5). For HIPAA, it could result in unauthorized access or destruction of protected health information, breaching security requirements.

Mitigation Strategies

Upgrade uv to version 0.11.6 or newer using 'uv self update'. Avoid installing untrusted wheels. Review installed packages and remove suspicious ones. Monitor system files for unauthorized deletions.

Hi! I’m here to help you understand CVE-2026-114110. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...