Bug 2558043 (CVE-2026-114110)
| Summary: | CVE-2026-114110 uv: uv: Arbitrary file deletion via directory traversal in package RECORD metadata | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alinfoot, anpicker, aprice, bbrownin, dtrifiro, ebourniv, gbenhaim, hasun, ilpinto, jfula, jowilson, jsamir, ltomasbo, mwoodson, niyer, nyancey, oezr, ometelka, ptisnovs, sbunciak, syedriko, twaugh, weaton, xdharmai, ykashtan |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in uv. This vulnerability allows an attacker to cause arbitrary file deletion by tricking a user into installing and subsequently uninstalling a specially crafted Python package. The issue occurs because uv fails to properly validate relative file paths listed in the package's record metadata, allowing paths that traverse outside the intended installation directory. When the package is uninstalled, uv removes those external files from the system.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-21 01:03:33 UTC
|