CVE-2026-114110— Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries
Quick assessment
Affected
astral-sh uv
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Astral uv 在 0.11.6 版本之前存在路径遍历漏洞，攻击者可通过在 RECORD 条目中提供包含相对遍历路径的 wheel 文件，从而删除任意文件。攻击者可构造恶意 wheel 包，使其 RECORD 文件引用安装前缀之外的文件，导致用户在卸载该包时，uv 会删除这些外部文件。
Possible ATT&CK Techniques 2 AI
T1565.001 · Stored Data Manipulation T1565.002 · Transmitted Data Manipulation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114110
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries
Source: CVE Program / CVE List V5
Vulnerability Description
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
相对路径遍历
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114110
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114110
请登录查看更多情报信息。
Other References for CVE-2026-114110 (2)
Same Patch Batch · astral-sh · 2026-10-21 · 3 CVEs total
| CVE-2026-114109 | 8.8 HIGH | uv before 0.11.15 Arbitrary File Write via Entry Point Names |
| CVE-2025-71437 | 6.5 MEDIUM | Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction |
IV. Related Vulnerabilities
Same product: uv
-
CVE-2026-114109
uv before 0.11.15 Arbitrary File Write via Entry Point Names -
CVE-2025-71437
Astral uv through 0.8.21 Path Traversal via Symlinks in Sdis -
CVE-2026-104843
uv: Path traversal on Windows through wheel extraction -
CVE-2025-13327
Uv: uv: specially crafted zip archives lead to arbitrary cod -
CVE-2025-54368
uv is vulnerable to ZIP payload obfuscation through parsing
Same vendor: astral-sh
-
CVE-2026-114109
uv before 0.11.15 Arbitrary File Write via Entry Point Names -
CVE-2025-71437
Astral uv through 0.8.21 Path Traversal via Symlinks in Sdis -
CVE-2026-104843
uv: Path traversal on Windows through wheel extraction -
CVE-2026-32766
astral-tokio-tar insufficiently validates PAX extensions dur -
CVE-2025-13327
Uv: uv: specially crafted zip archives lead to arbitrary cod
Same weakness: CWE-23
-
CVE-2026-111093
JetBrains Datalore <2026.2.1 未授权路径穿越漏洞 -
CVE-2026-103508
Path traversal via logging configuration in P4Search -
CVE-2026-41545
WebSocket timelapse path traversal and command injection -
CVE-2026-39993
Path Traversal to Root RCE in QNAP Download Station via Addo -
CVE-2026-76519
Cisco Secure Email Gateway Arbitrary File Write Vulnerabilit
V. Comments for CVE-2026-114110
No comments yet