CVE-2025-8869: pip Path Traversal Vulnerability

CVE-2025-8869 Overview

CVE-2025-8869 is a symlink vulnerability in pip's tar archive extraction functionality that affects Python environments not implementing PEP 706. When extracting tar archives, pip may fail to properly validate that symbolic links point within the intended extraction directory, potentially allowing an attacker to write files outside the expected location through a maliciously crafted source distribution (sdist).

This vulnerability specifically impacts pip's fallback implementation of tar extraction, which is used on Python versions that do not implement PEP 706. Users running Python versions >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12 with native PEP 706 support are not affected, as pip utilizes the secure tarfile implementation in these versions.

Critical Impact

Attackers can craft malicious source distributions (sdists) containing symbolic links that escape the extraction directory, potentially overwriting arbitrary files on the target system during package installation.

Affected Products

• pip (all versions prior to the fix) running on Python versions without PEP 706 implementation
• Python versions <3.9.17, <3.10.12, <3.11.4, or <3.12
• Systems installing untrusted Python packages from source distributions

Discovery Timeline

• 2025-09-24 - CVE-2025-8869 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-8869

Vulnerability Analysis

The vulnerability exists in pip's fallback tar extraction mechanism designed for Python interpreters that lack PEP 706 support. PEP 706 introduced security enhancements to Python's tarfile module to prevent directory traversal and symlink attacks during archive extraction.

When pip operates on a Python installation without PEP 706, it implements its own extraction logic to handle tar archives containing source distributions. However, this fallback implementation contains an insufficient check for symbolic links, failing to verify that symlink targets resolve to paths within the intended extraction directory.

An attacker can exploit this by crafting a malicious sdist containing a symbolic link that points to a location outside the extraction directory (e.g., ../../../etc/). When pip extracts this archive, subsequent files following the symlink in the archive can be written to arbitrary locations on the filesystem, subject to the permissions of the user running pip.

Root Cause

The root cause is improper validation of symbolic link targets during tar archive extraction in pip's fallback code path. The vulnerable code fails to canonicalize and verify that symlink destinations remain within the extraction directory boundary before creating the links, enabling path traversal via symlink following.

Attack Vector

This vulnerability is exploitable over the network when a user installs a malicious Python package from an untrusted source. The attack requires user interaction—specifically, the victim must execute a pip install command targeting a package containing the malicious tar archive.

The attack flow involves:

1. Attacker creates a malicious source distribution (sdist) containing a crafted symbolic link pointing outside the extraction directory
2. Attacker hosts or distributes this package through an accessible repository
3. Victim installs the malicious package using pip on a vulnerable Python version
4. During extraction, the symlink is created pointing to an attacker-controlled destination
5. Subsequent archive entries following the symlink are written to arbitrary filesystem locations

The vulnerability affects the integrity of the target system by allowing unauthorized file writes, though it does not directly impact confidentiality or availability.

Detection Methods for CVE-2025-8869

Indicators of Compromise

• Unexpected symbolic links created in Python package installation directories (site-packages)
• Modified system files that coincide with recent pip package installations
• Presence of suspicious source distributions containing symbolic links in pip's cache directory
• Unusual file modifications in system directories following pip install operations

Detection Strategies

• Audit pip installation logs for source distribution extractions on vulnerable Python versions
• Implement file integrity monitoring on critical system directories to detect unauthorized modifications
• Scan package caches and virtual environments for tar archives containing suspicious symbolic links
• Monitor for pip install commands from untrusted or non-PyPI sources

Monitoring Recommendations

• Deploy endpoint detection for anomalous file system writes during Python package installation processes
• Implement package verification workflows that inspect sdists before installation in CI/CD pipelines
• Configure security tools to alert on symbolic link creation in unexpected locations during pip operations
• Establish baseline Python version inventories to identify systems running vulnerable interpreter versions

How to Mitigate CVE-2025-8869

Immediate Actions Required

• Upgrade Python to a version implementing PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12)
• Update pip to a version containing the fix as referenced in GitHub Pull Request #13550
• Inspect all source distributions before installation, particularly from untrusted sources
• Prefer installation of pre-built wheels over source distributions where possible

Patch Information

The fix is available via GitHub Pull Request #13550. Users should upgrade pip to the patched version. The Python Security Announcement provides additional context. Debian users can reference the Debian LTS Security Notice for distribution-specific guidance.

Note that upgrading pip alone does not remediate all tarfile-related vulnerabilities—the recommended approach is upgrading to a Python version with native PEP 706 support.

Workarounds

• Upgrade Python to a version implementing PEP 706 to bypass the vulnerable fallback code entirely
• Manually inspect source distributions for suspicious symbolic links before installation
• Use --only-binary :all: flag with pip to prevent source distribution installation
• Apply the patch from the linked pull request manually if pip upgrade is not immediately feasible
• Restrict package installation to trusted sources such as PyPI with package signature verification

# Check Python version for PEP 706 support
python --version

# Upgrade pip to the latest patched version
pip install --upgrade pip

# Install packages using only pre-built wheels to avoid sdist extraction
pip install --only-binary :all: package_name

# Verify pip version after upgrade
pip --version