CVE-2025-8869

Medium

Advisory

Published 24 Sept 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,079; of 17,781 indexed, latest versions
Container images: 1,131; deployed by those charts
Fix available: 2 of 3; affected packages

pip's fallback tar extraction doesn't check symbolic links point to extraction directory

Carried by container images the latest versions of 1,079 of 17,781 indexed charts deploy, on 1,131 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+62 more	25.3	1,129
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+14 more	no fix listed	97
py3-pipapk	25.0.1-r0, 25.2-r0	25.2-r2	2

OSV records: CGA-2c2v-qg5x-gf3v CGA-2h56-9hwm-vvwr DEBIAN-CVE-2025-8869 GHSA-4xh5-x5gv-qwph UBUNTU-CVE-2025-8869
Also known as: CGA-2j52-82cx-jqm7, CGA-2vvp-4788-p685, CGA-38mx-66cv-5xhm, CGA-96x5-ppvf-355h, CGA-c923-5fqp-9gx9, CGA-c9f4-7rjc-ch6m, CGA-fvxf-h26j-p86m, CGA-h22m-qp2v-7fj8, CGA-m95p-j3wh-8jw6, CGA-w6hh-8hcg-xmhc, PYSEC-2026-1795

Charts affected

1,079 by stars

Chart

Latest

Affected images

Radar Score

data-fairdata354-helm

1.1.2

1 of 12 See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
apsl/thumbor :6.7.0	51e2de5c2c70	pip@19.3.1	25.3

Open the chart page →

38,346

datadogdatadog-test

2.4.23

1 of 2 See more

datadog datadog-test 2.4.23

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
datadog/agent :7.22.0	8f20e56b5311	pip@20.1.1	25.3

Open the chart page →

4,568

mealiedeimosfr-charts

1.0.15

1 of 1 See more

mealie deimosfr-charts 1.0.15

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.24.0	0b08ac3a9f0a	pip@25.0.1	25.3

Open the chart page →

4,028

weblatedeliveryhero

0.3.2

1 of 3 See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
weblate/weblate :4.2.2-1	69c160d37a3c	pip@20.2.2	25.3

Open the chart page →

7,984

frontenddemo-application

0.1.0

1 of 1 See more

frontend demo-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
azhar008/flaskapplication :latest	a1e827b0adea	pip@21.2.4	25.3

Open the chart page →

3,558

kubedashdevopstales

4.0.0

1 of 8 See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
devopstales/kubedash :3.1.0	8bb837da5aec	pip@24.0	25.3

Open the chart page →

9,205

trivy-operatordevopstales

2.5.0

1 of 1 See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
devopstales/trivy-operator :2.5	75136aa7a26e	pip@22.0.4	25.3

Open the chart page →

5,598

dominodomino

0.1.11

1 of 3 See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/tauffer-consulting/domino-rest :latest	8bf880fe8c73	pip@24.0	25.3

Open the chart page →

8,823

archerydouban

0.4.3

1 of 6 See more

5,853

seafiledr300481

0.12.1

1 of 1 See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
seafileltd/seafile-mc :11.0.12	d0c66e4621bd	pip@24.2	25.3

Open the chart page →

10,858

craftycontrollerdrewburr-labs-helm-charts

0.3.0

1 of 1 See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
registry.gitlab.com/crafty-controller/crafty-4 :latest	166a06f73d8c	pip@24.0	25.3

Open the chart page →

3,671

dyff-orchestratordyff-orchestrator

0.22.19

1 of 1 See more

dyff-orchestrator dyff-orchestrator 0.22.19

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
registry.gitlab.com/dyff/dyff-orchestrator :0.22.19	9bd5d93aaff7	pip@25.0.1	25.3

Open the chart page →

1,354

jenkinsedu

2.7.1

1 of 2 See more

4,423

enbuildenbuild

0.0.50

1 of 6 See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	pip@9.0.3	25.3

Open the chart page →

31,510

genesis-generatorethereum-helm-charts

0.2.3

1 of 2 See more

genesis-generator ethereum-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
skylenet/ethereum-genesis-generator :latest	210353ce7c89	pip@20.3.4	25.3

Open the chart page →

3,135

fastapi-microservice-appfast-api-microservice-app

1.3.0

3 of 4 See more

fastapi-microservice-app fast-api-microservice-app 1.3.0

3 of the 4 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
omkara25/simple-microservice-app-order-service :v2.1	8327546c7aac	pip@23.0.1	25.3
omkara25/simple-microservice-app-payment-service :v2	afff40172b6b	pip@23.0.1	25.3
omkara25/simple-microservice-app-user-service :v2	d62cba548580	pip@23.0.1	25.3

Open the chart page →

9,562

taigafermosit

0.0.11

2 of 7 See more

taiga fermosit 0.0.11

2 of the 7 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
taigaio/taiga-back :latest	4beed8f62c9f	pip@24.0	25.3
taigaio/taiga-protected :latest	fd4568a97a59	pip@24.0	25.3

Open the chart page →

8,496

pgadmin4folio-org

1.2.30

1 of 1 See more

2,034

appdaemongeek-cookbook

8.4.2

1 of 1 See more

appdaemon geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
acockburn/appdaemon :4.0.8	3a93281d7e94	pip@21.0.1	25.3

Open the chart page →

3,461

deepstackgeek-cookbook

1.5.2

1 of 2 See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
robmarkcole/deepstack-ui :latest	410275726459	pip@21.2.4	25.3

Open the chart page →

5,305

healthchecksgeek-cookbook

4.4.2

1 of 1 See more

healthchecks geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
linuxserver/healthchecks :version-v1.20.0	50792a72fc71	pip@21.1.1	25.3

Open the chart page →

1,667

homebridgegeek-cookbook

5.3.2

1 of 1 See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	25.3 no fix listed

Open the chart page →

15,653

kube-ops-viewgeek-cookbook

1.2.2

1 of 1 See more

kube-ops-view geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
hjacobs/kube-ops-view :20.4.0	58221b57d4d2	pip@20.0.2	25.3

Open the chart page →

1,848

lazylibrariangeek-cookbook

7.4.2

1 of 1 See more

lazylibrarian geek-cookbook 7.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
linuxserver/lazylibrarian :version-1152df82	f93d2560e233	pip@21.1.2	25.3

Open the chart page →

11,662

octoprintgeek-cookbook

6.4.2

1 of 1 See more

octoprint geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
octoprint/octoprint :1.6.1	ea3bffae2470	pip@21.1.2	25.3

Open the chart page →

3,153

paperlessgeek-cookbook

9.2.0

1 of 1 See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :1.8.0	9bbc9a90641e	pip@20.3.4	25.3

Open the chart page →

3,924

recipesgeek-cookbook

6.6.2

1 of 2 See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
vabene1111/recipes :1.0.5.2	ec4e9e2905b0	pip@21.3.1	25.3

Open the chart page →

7,801

uptime-kumageek-cookbook

1.4.2

1 of 1 See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :1.17.1	a4eab252e5a2	pip@18.1	25.3

Open the chart page →

5,079

uptimerobot-prometheusgeek-cookbook

6.4.2

1 of 1 See more

uptimerobot-prometheus geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
billimek/prometheus-uptimerobot-exporter :0.0.1	f14ccd7aad0e	pip@20.1.1	25.3

Open the chart page →

2,265

gentrace-self-hostedgentrace-self-hosted

0.1.3

1 of 9 See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :7.4.4	c0224a1adf7a	pip@9.0.3	25.3

Open the chart page →

15,562

temporalglasskube

0.45.2-gk.1

1 of 14 See more

temporal glasskube 0.45.2-gk.1

1 of the 14 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.25.0-tctl-1.18.1-cli-1.0.0	cda4901bab53	pip@23.3.1	25.3

Open the chart page →

16,346

octoprinthalkeye

0.1.1

1 of 1 See more

octoprint halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
octoprint/octoprint :1.4.0	106c26efcd8a	pip@20.3.1	25.3

Open the chart page →

3,608

powerdnsadminhalkeye

0.3.1

1 of 1 See more

powerdnsadmin halkeye 0.3.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :0.2.3	099371dd9ba6	pip@20.2.3	25.3

Open the chart page →

3,345

haproxy-redis-sentinelhaproxy-redis-sentinel

0.1.3

1 of 2 See more

haproxy-redis-sentinel haproxy-redis-sentinel 0.1.3

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/parmincloud/haproxy-redis-sentinel :1.0.0	40a00a6456ae	pip@25.0.1	25.3

Open the chart page →

4,277

harp-proxyharp

0.8.1

1 of 1 See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
makersquad/harp-proxy :0.8.1	a40dd258c527	pip@23.0.1 python-pip@23.0.1+dfsg-1	25.3 no fix listed

Open the chart page →

6,374

hasher-matcher-actionerhasher-matcher-actioner

1.0.0

1 of 1 See more

hasher-matcher-actioner hasher-matcher-actioner 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/facebook/threatexchange/hma :1.0.17	84d09c6b75a7	pip@24.0	25.3

Open the chart page →

910

uptimekumahelm-l3st86

0.1.10

1 of 1 See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :1.23.13	96510915e6be	pip@18.1	25.3

Open the chart page →

4,196

helmuphelmup

0.1.0

3 of 3 See more

helmup helmup 0.1.0

3 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
sirrend/helmup-engine :0.1.13	699e79e3d4e2	pip@24.0	25.3
sirrend/helmup-github-scraper :0.1.4	7ca688c7abf5	pip@24.0	25.3
sirrend/helmup-notifications-service :0.1.3	997866417011	pip@23.3.1	25.3

Open the chart page →

16,514

mongo-pod-labelerhmdmph

1.0.2

1 of 1 See more

mongo-pod-labeler hmdmph 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
hmdmph/mongo-pod-labeler :1.0.1-alpine	79e4a170f3dc	pip@19.0.3	25.3

Open the chart page →

1,205

hpe-greenlake-file-csi-driverhpe-storage

2.6.4

1 of 7 See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
quay.io/hpestorage/filex-csi-driver :2.6.4	b7f960bbf472	pip@21.3.1	25.3

Open the chart page →

6,095

huehue

1.0.3

1 of 3 See more

12,397

backendikusi-bk-chart

1.0.3

2 of 3 See more

backend ikusi-bk-chart 1.0.3

2 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
kyovint/kyoimgtransactions :1.0.0	48c19e3ae9a3	pip@24.0	25.3
kyovint/kyoimgusers :1.0.0	80084149156e	pip@24.0	25.3

Open the chart page →

5,940

immichimmich-helm

0.3.0

1 of 4 See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/immich-app/immich-machine-learning :v2.3.1	379e31b8c751	pip@24.0	25.3

Open the chart page →

15,712

supersetinseefrlab

1.4.0

1 of 4 See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
apache/superset :9cdaa280429ec297db16d56c94fd77b5d2aff107	975ab033580d	pip@21.2.4	25.3

Open the chart page →

7,129

iris-webappiris-webapp

0.2.4

1 of 2 See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	pip@23.0.1	25.3

Open the chart page →

11,764

jessejesse-chart

0.0.46

1 of 6 See more

3,421

jenkinsjkim

5.5.14

1 of 2 See more

7,387

alertmanager-gchat-integrationjulb-me

1.0.5

1 of 1 See more

alertmanager-gchat-integration julb-me 1.0.5

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
julb/alertmanager-gchat-integration :1.0.5	837c4038a0dd	pip@21.0.1	25.3

Open the chart page →

2,110

git-configmap-syncjulb-me

1.0.1

1 of 2 See more

git-configmap-sync julb-me 1.0.1

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
julb/kubernetes-configmap-sync :1.1.0	d7d8836366ad	pip@20.2.4	25.3

Open the chart page →

2,618

vmware-exporterkremers

2.3.0

1 of 1 See more

vmware-exporter kremers 2.3.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
pryorda/vmware_exporter :v0.18.4	79925e63e59f	pip@22.0.4	25.3

Open the chart page →

1,180

Container images carrying it

1,131 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
acockburn/appdaemon :4.0.8	3a93281d7e94	pip@21.0.1	25.3	1
afrank/mozalert-controller :latest	d463c37b08d7	pip@20.1.1	25.3	1
agentarea/agentarea-api :latest	9e15e16fa758	pip@25.0.1	25.3	1
agentarea/agentarea-mcp-runner :latest	d3c209a5d531	pip@25.0.1	25.3	1
agentarea/agentarea-worker :latest	1e5cb68ee77a	pip@25.0.1	25.3	1
ahmetgrbzz/result_server :1.0	08e10f9c0f53	pip@24.0	25.3	1
ahmetgrbzz/result_server :2.0	35c37ae2bafd	pip@24.0	25.3	1
ahmetgrbzz/web_server :1.0	2e7fef69c29f	pip@24.0	25.3	1
ahmetgrbzz/web_server :2.0	f018bafd2b0c	pip@24.0	25.3	1
aibrix/metadata-service :v0.7.0	63fb81a64377	pip@24.0	25.3	1
airbyte/manifest-server :7.23.7	3b3a670af168	pip@25.2	25.3	1
akeyless/base-rhel :0.0.1	4ba8900a0061	pip@20.2.4	25.3	1
aktosecurity/akto-agent-guard-anonymizer :1.1.4	d4b100cbdc47	pip@25.0.1	25.3	1
aktosecurity/akto-agent-guard-embedder :1.1.4	dbc566b2376c	pip@25.0.1	25.3	1
aktosecurity/akto-agent-guard-worker :1.1.4	666eaffd5362	pip@25.0.1	25.3	1
alaaamin/reload-count-tornado-py-app :v1.0.1alpine	46da5844794e	pip@22.0.4	25.3	1
alakaganaguathoork/local-business :latest	7eb27b0f4a5a	pip@25.0.1	25.3	1
alerta/alerta-web :8.5.0	4786b9eaa606	pip@20.1.1	25.3	1
alexeyr7/sf-test-app :latest	df0b41fdbd53	pip@22.0.4	25.3	1
alexvm6/generator :latest	fb99ee4f760a	pip@22.3.1	25.3	1
alexvm6/pythonalex :latest	89a05786879c	pip@22.3.1	25.3	1
alfresco/alfresco-activemq :5.18.7-jre17-rockylinux8	5472f88d9b0b	pip@9.0.3	25.3	1
allegroai/clearml :2.0.0-613	713ae38f7daf	pip@24.3.1	25.3	1
allegroai/clearml-agent-k8s-base :1.24-21	772827a01bb5	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.5	25.3 no fix listed	1
allegroai/clearml-serving-inference :1.3.0	fca885e8cfc6	pip@22.3.1	25.3	1
allegroai/clearml-serving-statistics :1.3.0	c58d9da7bdf8	pip@22.3.1	25.3	1
alpine/k8s :1.22.6	00ac10bcb759	pip@22.0.4	25.3	1
alpine/k8s :1.27.3	21b24e6bf801	pip@23.1.2	25.3	1
alpine/k8s :1.31.10	6dbe6f391eda	pip@25.1.1	25.3	1
alpine/k8s :1.31.13	7a319b15cfc9	pip@25.2	25.3	1
alpine/k8s :1.32.4	7e1e7d5b7a96	pip@25.1	25.3	1
alpine/k8s :1.31.4	9c4976d47656	pip@24.3.1	25.3	1
alpine/k8s :1.18.16	a41efe02a041	pip@21.2.1	25.3	1
alpine/k8s :1.30.0	bd01dae02676	pip@24.0	25.3	1
alpine/k8s :1.30.2	cd560fce90f7	pip@24.1.1	25.3	1
alpine/k8s :1.28.13	e5c0b053fed7	pip@24.2	25.3	1
alpine/k8s :1.32.3	eec354133193	pip@25.0.1	25.3	1
alpine/k8s :1.28.2	fc059f056ad0	pip@23.2.1	25.3	1
amagdi888/my-repo :hello-app	d8a10fc8faf6	pip@22.0.4	25.3	1
amancevice/superset :0.28.1	c8c04bfe3d66	pip@19.0.3	25.3	1
amd64/mysql :5.7	e20a653e0f51	pip@23.0.1	25.3	1
amundsendev/amundsen-frontend :2.1.1	69e7915e61c1	pip@20.0.2	25.3	1
amundsendev/amundsen-metadata :2.5.4	4d98eb21f5f9	pip@20.2.2	25.3	1
amundsendev/amundsen-search :2.4.0	99dda9502c3e	pip@20.2.2	25.3	1
anchore/anchore-engine :v0.10.0	bde9eedf639d	pip@19.3.1	25.3	1
anchore/anchore-engine :v0.7.1	ed9b3badd17c	pip@9.0.3	25.3	1
andrewgolikov55/intel-gpu-exporter :latest	fcc001b61c0e	pip@22.0.2	25.3	1
andreymileshin/kube-info :v0.1.0	f7b300bc9e66	pip@24.2	25.3	1
andreymileshin/zerossl-issuer :v1.0.0	e0825acc9e48	pip@24.2	25.3	1
apache/airflow :2.8.4-python3.9	64e58748b6b9	pip@24.0	25.3	1