CVE-2025-71437: Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-21 · updated 2026-10-28
Weakness: CWE-22

Description

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.

Affected products

astral-sh uv: through 0.8.21

References

https://github.com/astral-sh/uv/security/advisories/GHSA-7j9j-68r2-f35q
https://www.vulncheck.com/advisories/astral-uv-through-0.8.21-path-traversal-via-symlinks-in-sdist-tar-extraction

Get alerted when CVE-2025-71437 or the next vulnerability affects your stack