Path traversal in uv - CVE-2025-54368

Vulnerability identifier: #VU113804

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-54368

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing archive files. A remote attacker can pass a specially crafted .zip archive to the application and write file to arbitrary locations on the system, leading to a system compromise. 

uv
watsonx.data integration
Fedora
rust-h2
uv
python-uv-build

Install updates from vendor's website.

uv - update to 0.8.6
watsonx.data integration - update to 5.2.2
rust-h2 - addressed in versions 0.4.12-1.el10_1, 0.4.12-1.fc41, 0.4.12-1.fc42, 0.4.12-1.fc43
uv - addressed in versions 0.8.8-1.el10_1, 0.8.8-1.fc41, 0.8.8-1.fc42, 0.8.8-1.fc43
python-uv-build - update to 0.8.8-1.fc43

• https://astral.sh/blog/uv-security-advisory-cve-2025-54368
• https://blog.pypi.org/posts/2025-08-07-wheel-archive-confusion-attacks
• https://github.com/astral-sh/uv/commit/7f1eaf48c193e045ca2c62c4581048765c55505f
• https://github.com/astral-sh/uv/security/advisories/GHSA-8qf3-x8v5-2pj8

• Path traversal in Astral uv
• Fedora 43 update for python-uv-build, rust-h2, uv
• Fedora 42 update for rust-h2, uv
• Fedora 41 update for rust-h2, uv
• Fedora EPEL 10.1 update for rust-h2, uv
• Multiple vulnerabilities in IBM watsonx.data integration