CVE-2025-8869

Medium

Advisory

Published 24 Sept 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,085; of 17,787 indexed, latest versions
Container images: 1,138; deployed by those charts
Fix available: 2 of 3; affected packages

pip's fallback tar extraction doesn't check symbolic links point to extraction directory

Carried by container images the latest versions of 1,085 of 17,787 indexed charts deploy, on 1,138 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+62 more	25.3	1,136
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+14 more	no fix listed	97
py3-pipapk	25.0.1-r0, 25.2-r0	25.2-r2	2

OSV records: CGA-2c2v-qg5x-gf3v CGA-2h56-9hwm-vvwr DEBIAN-CVE-2025-8869 GHSA-4xh5-x5gv-qwph UBUNTU-CVE-2025-8869
Also known as: CGA-2j52-82cx-jqm7, CGA-2vvp-4788-p685, CGA-38mx-66cv-5xhm, CGA-96x5-ppvf-355h, CGA-c923-5fqp-9gx9, CGA-c9f4-7rjc-ch6m, CGA-fvxf-h26j-p86m, CGA-h22m-qp2v-7fj8, CGA-m95p-j3wh-8jw6, CGA-w6hh-8hcg-xmhc, PYSEC-2026-1795

Charts affected

1,085 by stars

Chart

Latest

Affected images

Radar Score

data-fairdata354-helm

1.1.2

1 of 12 See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
apsl/thumbor :6.7.0	51e2de5c2c70	pip@19.3.1	25.3

Open the chart page →

38,424

datadogdatadog-test

2.4.23

1 of 2 See more

datadog datadog-test 2.4.23

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
datadog/agent :7.22.0	8f20e56b5311	pip@20.1.1	25.3

Open the chart page →

4,570

mealiedeimosfr-charts

1.0.15

1 of 1 See more

mealie deimosfr-charts 1.0.15

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.24.0	0b08ac3a9f0a	pip@25.0.1	25.3

Open the chart page →

4,042

weblatedeliveryhero

0.3.2

1 of 3 See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
weblate/weblate :4.2.2-1	69c160d37a3c	pip@20.2.2	25.3

Open the chart page →

7,987

frontenddemo-application

0.1.0

1 of 1 See more

frontend demo-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
azhar008/flaskapplication :latest	a1e827b0adea	pip@21.2.4	25.3

Open the chart page →

3,558

kubedashdevopstales

4.0.0

1 of 8 See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
devopstales/kubedash :3.1.0	8bb837da5aec	pip@24.0	25.3

Open the chart page →

9,239

trivy-operatordevopstales

2.5.0

1 of 1 See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
devopstales/trivy-operator :2.5	75136aa7a26e	pip@22.0.4	25.3

Open the chart page →

5,599

dominodomino

0.1.11

1 of 3 See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/tauffer-consulting/domino-rest :latest	8bf880fe8c73	pip@24.0	25.3

Open the chart page →

8,842

archerydouban

0.4.3

1 of 6 See more

5,854

seafiledr300481

0.12.1

1 of 1 See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
seafileltd/seafile-mc :11.0.12	d0c66e4621bd	pip@24.2	25.3

Open the chart page →

10,884

craftycontrollerdrewburr-labs-helm-charts

0.3.0

1 of 1 See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
registry.gitlab.com/crafty-controller/crafty-4 :latest	166a06f73d8c	pip@24.0	25.3

Open the chart page →

3,732

dyff-orchestratordyff-orchestrator

0.22.19

1 of 1 See more

dyff-orchestrator dyff-orchestrator 0.22.19

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
registry.gitlab.com/dyff/dyff-orchestrator :0.22.19	9bd5d93aaff7	pip@25.0.1	25.3

Open the chart page →

1,279

jenkinsedu

2.7.1

1 of 2 See more

4,434

enbuildenbuild

0.0.50

1 of 6 See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	pip@9.0.3	25.3

Open the chart page →

31,572

genesis-generatorethereum-helm-charts

0.2.3

1 of 2 See more

genesis-generator ethereum-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
skylenet/ethereum-genesis-generator :latest	210353ce7c89	pip@20.3.4	25.3

Open the chart page →

3,135

fastapi-microservice-appfast-api-microservice-app

1.3.0

3 of 4 See more

fastapi-microservice-app fast-api-microservice-app 1.3.0

3 of the 4 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
omkara25/simple-microservice-app-order-service :v2.1	8327546c7aac	pip@23.0.1	25.3
omkara25/simple-microservice-app-payment-service :v2	afff40172b6b	pip@23.0.1	25.3
omkara25/simple-microservice-app-user-service :v2	d62cba548580	pip@23.0.1	25.3

Open the chart page →

9,619

taigafermosit

0.0.11

2 of 7 See more

taiga fermosit 0.0.11

2 of the 7 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
taigaio/taiga-back :latest	4beed8f62c9f	pip@24.0	25.3
taigaio/taiga-protected :latest	fd4568a97a59	pip@24.0	25.3

Open the chart page →

8,520

pgadmin4folio-org

1.2.30

1 of 1 See more

2,034

appdaemongeek-cookbook

8.4.2

1 of 1 See more

appdaemon geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
acockburn/appdaemon :4.0.8	3a93281d7e94	pip@21.0.1	25.3

Open the chart page →

3,461

deepstackgeek-cookbook

1.5.2

1 of 2 See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
robmarkcole/deepstack-ui :latest	410275726459	pip@21.2.4	25.3

Open the chart page →

5,305

healthchecksgeek-cookbook

4.4.2

1 of 1 See more

healthchecks geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
linuxserver/healthchecks :version-v1.20.0	50792a72fc71	pip@21.1.1	25.3

Open the chart page →

1,667

homebridgegeek-cookbook

5.3.2

1 of 1 See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	25.3 no fix listed

Open the chart page →

15,717

kube-ops-viewgeek-cookbook

1.2.2

1 of 1 See more

kube-ops-view geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
hjacobs/kube-ops-view :20.4.0	58221b57d4d2	pip@20.0.2	25.3

Open the chart page →

1,848

lazylibrariangeek-cookbook

7.4.2

1 of 1 See more

lazylibrarian geek-cookbook 7.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
linuxserver/lazylibrarian :version-1152df82	f93d2560e233	pip@21.1.2	25.3

Open the chart page →

11,684

octoprintgeek-cookbook

6.4.2

1 of 1 See more

octoprint geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
octoprint/octoprint :1.6.1	ea3bffae2470	pip@21.1.2	25.3

Open the chart page →

3,154

paperlessgeek-cookbook

9.2.0

1 of 1 See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :1.8.0	9bbc9a90641e	pip@20.3.4	25.3

Open the chart page →

3,924

recipesgeek-cookbook

6.6.2

1 of 2 See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
vabene1111/recipes :1.0.5.2	ec4e9e2905b0	pip@21.3.1	25.3

Open the chart page →

7,801

uptime-kumageek-cookbook

1.4.2

1 of 1 See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :1.17.1	a4eab252e5a2	pip@18.1	25.3

Open the chart page →

5,079

uptimerobot-prometheusgeek-cookbook

6.4.2

1 of 1 See more

uptimerobot-prometheus geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
billimek/prometheus-uptimerobot-exporter :0.0.1	f14ccd7aad0e	pip@20.1.1	25.3

Open the chart page →

2,265

gentrace-self-hostedgentrace-self-hosted

0.1.3

1 of 9 See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :7.4.4	c0224a1adf7a	pip@9.0.3	25.3

Open the chart page →

15,606

temporalglasskube

0.45.2-gk.1

1 of 14 See more

temporal glasskube 0.45.2-gk.1

1 of the 14 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.25.0-tctl-1.18.1-cli-1.0.0	cda4901bab53	pip@23.3.1	25.3

Open the chart page →

16,345

octoprinthalkeye

0.1.1

1 of 1 See more

octoprint halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
octoprint/octoprint :1.4.0	106c26efcd8a	pip@20.3.1	25.3

Open the chart page →

3,608

powerdnsadminhalkeye

0.3.1

1 of 1 See more

powerdnsadmin halkeye 0.3.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :0.2.3	099371dd9ba6	pip@20.2.3	25.3

Open the chart page →

3,345

haproxy-redis-sentinelhaproxy-redis-sentinel

0.1.3

1 of 2 See more

haproxy-redis-sentinel haproxy-redis-sentinel 0.1.3

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/parmincloud/haproxy-redis-sentinel :1.0.0	40a00a6456ae	pip@25.0.1	25.3

Open the chart page →

4,295

harp-proxyharp

0.8.1

1 of 1 See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
makersquad/harp-proxy :0.8.1	a40dd258c527	pip@23.0.1 python-pip@23.0.1+dfsg-1	25.3 no fix listed

Open the chart page →

6,092

hasher-matcher-actionerhasher-matcher-actioner

1.0.0

1 of 1 See more

hasher-matcher-actioner hasher-matcher-actioner 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/facebook/threatexchange/hma :1.0.17	84d09c6b75a7	pip@24.0	25.3

Open the chart page →

910

uptimekumahelm-l3st86

0.1.10

1 of 1 See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :1.23.13	96510915e6be	pip@18.1	25.3

Open the chart page →

4,196

helmuphelmup

0.1.0

3 of 3 See more

helmup helmup 0.1.0

3 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
sirrend/helmup-engine :0.1.13	699e79e3d4e2	pip@24.0	25.3
sirrend/helmup-github-scraper :0.1.4	7ca688c7abf5	pip@24.0	25.3
sirrend/helmup-notifications-service :0.1.3	997866417011	pip@23.3.1	25.3

Open the chart page →

16,532

mongo-pod-labelerhmdmph

1.0.2

1 of 1 See more

mongo-pod-labeler hmdmph 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
hmdmph/mongo-pod-labeler :1.0.1-alpine	79e4a170f3dc	pip@19.0.3	25.3

Open the chart page →

1,205

hpe-greenlake-file-csi-driverhpe-storage

2.6.4

1 of 7 See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
quay.io/hpestorage/filex-csi-driver :2.6.4	b7f960bbf472	pip@21.3.1	25.3

Open the chart page →

6,131

huehue

1.0.3

1 of 3 See more

12,461

backendikusi-bk-chart

1.0.3

2 of 3 See more

backend ikusi-bk-chart 1.0.3

2 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
kyovint/kyoimgtransactions :1.0.0	48c19e3ae9a3	pip@24.0	25.3
kyovint/kyoimgusers :1.0.0	80084149156e	pip@24.0	25.3

Open the chart page →

5,976

immichimmich-helm

0.3.0

1 of 4 See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/immich-app/immich-machine-learning :v2.3.1	379e31b8c751	pip@24.0	25.3

Open the chart page →

15,749

supersetinseefrlab

1.4.0

1 of 4 See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
apache/superset :9cdaa280429ec297db16d56c94fd77b5d2aff107	975ab033580d	pip@21.2.4	25.3

Open the chart page →

7,130

iris-webappiris-webapp

0.2.4

1 of 2 See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	pip@23.0.1	25.3

Open the chart page →

11,794

jessejesse-chart

0.0.46

1 of 6 See more

3,423

jenkinsjkim

5.5.14

1 of 2 See more

7,393

alertmanager-gchat-integrationjulb-me

1.0.5

1 of 1 See more

alertmanager-gchat-integration julb-me 1.0.5

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
julb/alertmanager-gchat-integration :1.0.5	837c4038a0dd	pip@21.0.1	25.3

Open the chart page →

2,110

git-configmap-syncjulb-me

1.0.1

1 of 2 See more

git-configmap-sync julb-me 1.0.1

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
julb/kubernetes-configmap-sync :1.1.0	d7d8836366ad	pip@20.2.4	25.3

Open the chart page →

2,619

vmware-exporterkremers

2.3.0

1 of 1 See more

vmware-exporter kremers 2.3.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
pryorda/vmware_exporter :v0.18.4	79925e63e59f	pip@22.0.4	25.3

Open the chart page →

1,180

Container images carrying it

1,138 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/kiwigrid/k8s-sidecar :1.21.0	710e23b489c5	pip@22.3.1	25.3	1
quay.io/kiwigrid/k8s-sidecar :1.30.10	835d79d8fbae	pip@25.2	25.3	1
quay.io/kiwigrid/k8s-sidecar :1.15.1	a25886092fa4	pip@21.2.4	25.3	1
quay.io/kiwigrid/k8s-sidecar :1.25.2	cb4c638ffb1f	pip@23.2.1	25.3	1
quay.io/maximilianopizarro/neuroface-backend :v1.4.1	3194d46df0f9	pip@22.3.1	25.3	1
quay.io/maximilianopizarro/neuroface-backend :latest	cba71dc08c8a	pip@22.3.1	25.3	1
quay.io/maxiv/storageclass-router :0.4.1	60725dab588c	pip@24.0	25.3	1
quay.io/mongodb/farm-intro-backend :0.1	1a9ce0b8fbd4	pip@21.2.4	25.3	1
quay.io/netscaler/netscaler-cpx :14.1-66.59	8602e36d4564	pip@22.0.4	25.3	1
quay.io/netscaler/netscaler-k8s-ingress-controller :4.1.17	55b12c2a8440	pip@24.0	25.3	1
quay.io/netscaler/netscaler-k8s-ingress-controller :4.2.26	a68453858339	pip@24.0	25.3	1
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	pip@22.0.4	25.3	1
quay.io/ongres/kubectl :v1.25.16-build-6.53	04dada9e4503	pip@23.2.1	25.3	1
quay.io/openshift/origin-cli :4.6	6722d5041b47	pip@9.0.3	25.3	1
quay.io/openshift/origin-console :4.10.0	0bbe8b451fa3	pip@9.0.3	25.3	1
quay.io/openshift/origin-jenkins-agent-base :latest	c241c971aef8	pip@9.0.3	25.3	1
quay.io/opsmxpublic/awsgit :v2-openssh	0d21ba756f44	pip@22.0.3	25.3	1
quay.io/opsmxpublic/awsgit :v3-js	15a6faada3d4	pip@22.0.4	25.3	1
quay.io/opsmxpublic/ubi8-oes-db :v3.0.0	89ee6493af89	pip@9.0.3	25.3	1
quay.io/opsmxpublic/ubi8-oes-platform :isd-spin-2025.10.01-a7c191ec-202511261122	8ed603ab7417	pip@9.0.3	25.3	1
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	pip@24.0	25.3	1
quay.io/rhdh/rhdh-hub-rhel9 :latest	0b26358f5793	pip@22.3.1	25.3	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	pip@20.2.4	25.3	1
quay.io/soketi/pws :0.8-16-alpine	399d2e6b10ef	pip@21.2.4	25.3	1
quay.io/stackgres/operator :1.19.1	f241b0b20326	pip@23.2.1	25.3	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	pip@23.0.1	25.3	1
registry.gitlab.com/crafty-controller/crafty-4 :latest	166a06f73d8c	pip@24.0	25.3	1
registry.gitlab.com/dyff/dyff-api :0.57.4	911acf4052e5	pip@25.0.1	25.3	1
registry.gitlab.com/dyff/dyff-orchestrator :0.22.19	9bd5d93aaff7	pip@25.0.1	25.3	1
registry.gitlab.com/dyff/workflows-sink :0.16.3	564718e28931	pip@25.0.1	25.3	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	pip@9.0.3	25.3	1
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	pip@20.0.2 python-pip@20.0.2-5ubuntu1.1	25.3 no fix listed	1
registry.gitlab.com/open-forms/design-catalogue :latest	f21f19346b29	pip@20.3.3	25.3	1
registry.gitlab.com/open-forms/forms-catalogue :latest	4eaf9c911f33	pip@21.2.4	25.3	1
registry.gitlab.com/open-forms/request-registry :latest	0886cbbc5f95	pip@21.2.4	25.3	1
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	pip@22.0.4	25.3	1
registry.gitlab.com/xrow-public/ci-tools/tools :main	9b9d1ed86b6a	pip@23.3.2	25.3	1
registry.gitlab.com/xrow-public/helm-smtp/postfix :1.3.3	7eea4f0883dd	pip@25.0.1	25.3	1