CVE-2025-8869
BaseFortify
Publication date: 2025-09-24
Last updated on: 2025-11-03
Assigner: Python Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pypa | pip | * |
| pypa | pip | 20.3.4-4+deb11u2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when pip extracts a tar archive using a fallback implementation that does not properly check if symbolic links point inside the extraction directory. This happens if the Python tarfile module does not implement PEP 706. As a result, malicious tar archives could potentially create symbolic links that point outside the intended extraction directory, leading to security risks. The issue affects pip versions running on Python versions that lack PEP 706 support.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to craft tar archives with symbolic links that point outside the extraction directory, potentially leading to unauthorized file overwrites or access to files outside the intended area. This can compromise system integrity or security when installing packages using pip on affected Python versions.
What immediate steps should I take to mitigate this vulnerability?
Immediate steps to mitigate this vulnerability include upgrading pip to a version that includes the fix, upgrading your Python version to one that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch if available, and inspecting source distributions (sdists) before installation as a best practice.