Astral uv Path Traversal in Source Distribution Extraction Allows Arbitrary File Write
A high-severity flaw in Astral uv versions before 0.8.22 lets attackers write files outside the intended directory via crafted symlinks in source distributions.
Key points
- CVE-2025-71437 affects Astral uv versions prior to 0.8.22 and is rated High severity with a CVSS score of 8.7.
- The vulnerability stems from insufficient validation of symbolic links during the extraction of source distribution tarballs.
- Attackers can install malicious packages that write arbitrary files to locations outside the designated installation prefix.
Astral uv contains a path traversal vulnerability in its source distribution extraction logic. The flaw, tracked as CVE-2025-71437, allows an attacker to redirect file writes outside the intended extraction prefix. This occurs when the tool processes a specially crafted sequence of symbolic links within a source distribution tarball. As NetSec Observer reported on 2026-10-20, similar path traversal issues have previously allowed arbitrary file downloads in other software, highlighting the persistent risk of improper directory handling. Environments relying on uv for dependency management are exposed to this issue if they install unverified or malicious source distributions.
Root cause
The underlying weakness is classified as CWE-22, or Improper Limitation of a Pathname to a Restricted Directory. In this specific instance, the extraction process for source distribution tarballs fails to adequately validate symbolic links. When uv extracts a tarball containing these crafted symlinks, it follows the link targets rather than restricting writes to the expected directory. This behavior allows the extraction routine to write data to arbitrary locations on the filesystem. The vulnerability exists in versions of uv up to and including 0.8.21.
Attack path
An attacker begins by creating a malicious source distribution package. This package includes a tarball with a carefully constructed sequence of symbolic links. The symlinks are designed to point outside the standard installation directory when the archive is unpacked. The attacker then publishes this malicious package to a package index or shares it directly with a victim. When a user installs this package using an affected version of uv, the tool extracts the contents. During extraction, the symlinks redirect the file writes, allowing the attacker to place arbitrary files in sensitive filesystem locations.
Affected versions
- Astral uv version 0.8.21
- Astral uv version 0.8.20
- Astral uv version 0.8.19
- All earlier versions of Astral uv before 0.8.22
Mitigation
- Upgrade Astral uv to version 0.8.22 or later to resolve the path traversal vulnerability.
- Audit installed packages for any source distributions that may contain malicious symlinks or unexpected file writes.
- Restrict package installation to trusted repositories to reduce the risk of installing compromised source distributions.
- Monitor filesystem integrity in installation directories to detect unauthorized file creation or modification outside expected paths.
Signals worth monitoring
Security teams should monitor for unusual file creation events in directories outside the standard package installation paths. Look for symbolic links in extracted archives that point to sensitive system locations. Alert on unexpected writes to configuration files or executable directories during package installation processes. Check whether automated build pipelines are installing packages from untrusted sources without verification. Teams usually review logs for failed permission checks or access violations during extraction. Containment moves include isolating affected systems and verifying the integrity of critical files.
What to do and how to stay safe: Astral uv
- Verify your current version of Astral uv and upgrade to 0.8.22 or newer as soon as possible.
- Scan your environment for any recently installed source distributions that may contain malicious symlinks.
- Review package sources to ensure you are only installing from trusted and verified repositories.
- Monitor filesystem changes in installation directories to detect any unauthorized file writes or modifications.
Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views
General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2025-71437?
It is a path traversal vulnerability in Astral uv that allows attackers to write files outside the intended directory via crafted symlinks in source distributions.
Which versions of Astral uv are affected?
All versions of Astral uv before 0.8.22 are affected by this vulnerability.
How is the severity of this vulnerability rated?
The vulnerability has a CVSS score of 8.7, which is rated as High severity.
