---
id: GHSA-m3wx-qqmx-qxvf
title: >-
  Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD
  entries
summary: >-
  Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD
  entries
severity: high
cvss: 5.3
cwe:
  - CWE-23
vendor: uv
product: uv
ecosystem: pip
affected:
  - uv < 0.11.6
published: '2026-10-21'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T20:57:27Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-m3wx-qqmx-qxvf'
references:
  - url: 'https://github.com/astral-sh/uv/security/advisories/GHSA-pjjw-68hj-v9mw'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114110'
  - url: >-
      https://www.vulncheck.com/advisories/astral-uv-before-0.11.6-arbitrary-file-deletion-via-wheel-record-entries
  - url: 'https://github.com/advisories/GHSA-m3wx-qqmx-qxvf'
tags:
  - ghsa
  - pip
ingestedAt: '2026-10-23T21:38:13.037Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pjjw-68hj-v9mw. This link is maintained to preserve external references.

## Original Description
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.

## Affected packages

- `uv < 0.11.6`

## Remediation

Refer to the advisory for the patched release.