CVE-2025-8869

Medium

Advisory

Published 24 Sept 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,079; of 17,781 indexed, latest versions
Container images: 1,131; deployed by those charts
Fix available: 2 of 3; affected packages

pip's fallback tar extraction doesn't check symbolic links point to extraction directory

Carried by container images the latest versions of 1,079 of 17,781 indexed charts deploy, on 1,131 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+62 more	25.3	1,129
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+14 more	no fix listed	97
py3-pipapk	25.0.1-r0, 25.2-r0	25.2-r2	2

OSV records: CGA-2c2v-qg5x-gf3v CGA-2h56-9hwm-vvwr DEBIAN-CVE-2025-8869 GHSA-4xh5-x5gv-qwph UBUNTU-CVE-2025-8869
Also known as: CGA-2j52-82cx-jqm7, CGA-2vvp-4788-p685, CGA-38mx-66cv-5xhm, CGA-96x5-ppvf-355h, CGA-c923-5fqp-9gx9, CGA-c9f4-7rjc-ch6m, CGA-fvxf-h26j-p86m, CGA-h22m-qp2v-7fj8, CGA-m95p-j3wh-8jw6, CGA-w6hh-8hcg-xmhc, PYSEC-2026-1795

Charts affected

1,079 by stars

Chart

Latest

Affected images

Radar Score

data-fairdata354-helm

1.1.2

1 of 12 See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
apsl/thumbor :6.7.0	51e2de5c2c70	pip@19.3.1	25.3

Open the chart page →

38,346

datadogdatadog-test

2.4.23

1 of 2 See more

datadog datadog-test 2.4.23

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
datadog/agent :7.22.0	8f20e56b5311	pip@20.1.1	25.3

Open the chart page →

4,568

mealiedeimosfr-charts

1.0.15

1 of 1 See more

mealie deimosfr-charts 1.0.15

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.24.0	0b08ac3a9f0a	pip@25.0.1	25.3

Open the chart page →

4,028

weblatedeliveryhero

0.3.2

1 of 3 See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
weblate/weblate :4.2.2-1	69c160d37a3c	pip@20.2.2	25.3

Open the chart page →

7,984

frontenddemo-application

0.1.0

1 of 1 See more

frontend demo-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
azhar008/flaskapplication :latest	a1e827b0adea	pip@21.2.4	25.3

Open the chart page →

3,558

kubedashdevopstales

4.0.0

1 of 8 See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
devopstales/kubedash :3.1.0	8bb837da5aec	pip@24.0	25.3

Open the chart page →

9,205

trivy-operatordevopstales

2.5.0

1 of 1 See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
devopstales/trivy-operator :2.5	75136aa7a26e	pip@22.0.4	25.3

Open the chart page →

5,598

dominodomino

0.1.11

1 of 3 See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/tauffer-consulting/domino-rest :latest	8bf880fe8c73	pip@24.0	25.3

Open the chart page →

8,823

archerydouban

0.4.3

1 of 6 See more

5,853

seafiledr300481

0.12.1

1 of 1 See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
seafileltd/seafile-mc :11.0.12	d0c66e4621bd	pip@24.2	25.3

Open the chart page →

10,858

craftycontrollerdrewburr-labs-helm-charts

0.3.0

1 of 1 See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
registry.gitlab.com/crafty-controller/crafty-4 :latest	166a06f73d8c	pip@24.0	25.3

Open the chart page →

3,671

dyff-orchestratordyff-orchestrator

0.22.19

1 of 1 See more

dyff-orchestrator dyff-orchestrator 0.22.19

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
registry.gitlab.com/dyff/dyff-orchestrator :0.22.19	9bd5d93aaff7	pip@25.0.1	25.3

Open the chart page →

1,354

jenkinsedu

2.7.1

1 of 2 See more

4,423

enbuildenbuild

0.0.50

1 of 6 See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	pip@9.0.3	25.3

Open the chart page →

31,510

genesis-generatorethereum-helm-charts

0.2.3

1 of 2 See more

genesis-generator ethereum-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
skylenet/ethereum-genesis-generator :latest	210353ce7c89	pip@20.3.4	25.3

Open the chart page →

3,135

fastapi-microservice-appfast-api-microservice-app

1.3.0

3 of 4 See more

fastapi-microservice-app fast-api-microservice-app 1.3.0

3 of the 4 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
omkara25/simple-microservice-app-order-service :v2.1	8327546c7aac	pip@23.0.1	25.3
omkara25/simple-microservice-app-payment-service :v2	afff40172b6b	pip@23.0.1	25.3
omkara25/simple-microservice-app-user-service :v2	d62cba548580	pip@23.0.1	25.3

Open the chart page →

9,562

taigafermosit

0.0.11

2 of 7 See more

taiga fermosit 0.0.11

2 of the 7 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
taigaio/taiga-back :latest	4beed8f62c9f	pip@24.0	25.3
taigaio/taiga-protected :latest	fd4568a97a59	pip@24.0	25.3

Open the chart page →

8,496

pgadmin4folio-org

1.2.30

1 of 1 See more

2,034

appdaemongeek-cookbook

8.4.2

1 of 1 See more

appdaemon geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
acockburn/appdaemon :4.0.8	3a93281d7e94	pip@21.0.1	25.3

Open the chart page →

3,461

deepstackgeek-cookbook

1.5.2

1 of 2 See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
robmarkcole/deepstack-ui :latest	410275726459	pip@21.2.4	25.3

Open the chart page →

5,305

healthchecksgeek-cookbook

4.4.2

1 of 1 See more

healthchecks geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
linuxserver/healthchecks :version-v1.20.0	50792a72fc71	pip@21.1.1	25.3

Open the chart page →

1,667

homebridgegeek-cookbook

5.3.2

1 of 1 See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	25.3 no fix listed

Open the chart page →

15,653

kube-ops-viewgeek-cookbook

1.2.2

1 of 1 See more

kube-ops-view geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
hjacobs/kube-ops-view :20.4.0	58221b57d4d2	pip@20.0.2	25.3

Open the chart page →

1,848

lazylibrariangeek-cookbook

7.4.2

1 of 1 See more

lazylibrarian geek-cookbook 7.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
linuxserver/lazylibrarian :version-1152df82	f93d2560e233	pip@21.1.2	25.3

Open the chart page →

11,662

octoprintgeek-cookbook

6.4.2

1 of 1 See more

octoprint geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
octoprint/octoprint :1.6.1	ea3bffae2470	pip@21.1.2	25.3

Open the chart page →

3,153

paperlessgeek-cookbook

9.2.0

1 of 1 See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :1.8.0	9bbc9a90641e	pip@20.3.4	25.3

Open the chart page →

3,924

recipesgeek-cookbook

6.6.2

1 of 2 See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
vabene1111/recipes :1.0.5.2	ec4e9e2905b0	pip@21.3.1	25.3

Open the chart page →

7,801

uptime-kumageek-cookbook

1.4.2

1 of 1 See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :1.17.1	a4eab252e5a2	pip@18.1	25.3

Open the chart page →

5,079

uptimerobot-prometheusgeek-cookbook

6.4.2

1 of 1 See more

uptimerobot-prometheus geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
billimek/prometheus-uptimerobot-exporter :0.0.1	f14ccd7aad0e	pip@20.1.1	25.3

Open the chart page →

2,265

gentrace-self-hostedgentrace-self-hosted

0.1.3

1 of 9 See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :7.4.4	c0224a1adf7a	pip@9.0.3	25.3

Open the chart page →

15,562

temporalglasskube

0.45.2-gk.1

1 of 14 See more

temporal glasskube 0.45.2-gk.1

1 of the 14 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.25.0-tctl-1.18.1-cli-1.0.0	cda4901bab53	pip@23.3.1	25.3

Open the chart page →

16,346

octoprinthalkeye

0.1.1

1 of 1 See more

octoprint halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
octoprint/octoprint :1.4.0	106c26efcd8a	pip@20.3.1	25.3

Open the chart page →

3,608

powerdnsadminhalkeye

0.3.1

1 of 1 See more

powerdnsadmin halkeye 0.3.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :0.2.3	099371dd9ba6	pip@20.2.3	25.3

Open the chart page →

3,345

haproxy-redis-sentinelhaproxy-redis-sentinel

0.1.3

1 of 2 See more

haproxy-redis-sentinel haproxy-redis-sentinel 0.1.3

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/parmincloud/haproxy-redis-sentinel :1.0.0	40a00a6456ae	pip@25.0.1	25.3

Open the chart page →

4,277

harp-proxyharp

0.8.1

1 of 1 See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
makersquad/harp-proxy :0.8.1	a40dd258c527	pip@23.0.1 python-pip@23.0.1+dfsg-1	25.3 no fix listed

Open the chart page →

6,374

hasher-matcher-actionerhasher-matcher-actioner

1.0.0

1 of 1 See more

hasher-matcher-actioner hasher-matcher-actioner 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/facebook/threatexchange/hma :1.0.17	84d09c6b75a7	pip@24.0	25.3

Open the chart page →

910

uptimekumahelm-l3st86

0.1.10

1 of 1 See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :1.23.13	96510915e6be	pip@18.1	25.3

Open the chart page →

4,196

helmuphelmup

0.1.0

3 of 3 See more

helmup helmup 0.1.0

3 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
sirrend/helmup-engine :0.1.13	699e79e3d4e2	pip@24.0	25.3
sirrend/helmup-github-scraper :0.1.4	7ca688c7abf5	pip@24.0	25.3
sirrend/helmup-notifications-service :0.1.3	997866417011	pip@23.3.1	25.3

Open the chart page →

16,514

mongo-pod-labelerhmdmph

1.0.2

1 of 1 See more

mongo-pod-labeler hmdmph 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
hmdmph/mongo-pod-labeler :1.0.1-alpine	79e4a170f3dc	pip@19.0.3	25.3

Open the chart page →

1,205

hpe-greenlake-file-csi-driverhpe-storage

2.6.4

1 of 7 See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
quay.io/hpestorage/filex-csi-driver :2.6.4	b7f960bbf472	pip@21.3.1	25.3

Open the chart page →

6,095

huehue

1.0.3

1 of 3 See more

12,397

backendikusi-bk-chart

1.0.3

2 of 3 See more

backend ikusi-bk-chart 1.0.3

2 of the 3 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
kyovint/kyoimgtransactions :1.0.0	48c19e3ae9a3	pip@24.0	25.3
kyovint/kyoimgusers :1.0.0	80084149156e	pip@24.0	25.3

Open the chart page →

5,940

immichimmich-helm

0.3.0

1 of 4 See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/immich-app/immich-machine-learning :v2.3.1	379e31b8c751	pip@24.0	25.3

Open the chart page →

15,712

supersetinseefrlab

1.4.0

1 of 4 See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
apache/superset :9cdaa280429ec297db16d56c94fd77b5d2aff107	975ab033580d	pip@21.2.4	25.3

Open the chart page →

7,129

iris-webappiris-webapp

0.2.4

1 of 2 See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	pip@23.0.1	25.3

Open the chart page →

11,764

jessejesse-chart

0.0.46

1 of 6 See more

3,421

jenkinsjkim

5.5.14

1 of 2 See more

7,387

alertmanager-gchat-integrationjulb-me

1.0.5

1 of 1 See more

alertmanager-gchat-integration julb-me 1.0.5

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
julb/alertmanager-gchat-integration :1.0.5	837c4038a0dd	pip@21.0.1	25.3

Open the chart page →

2,110

git-configmap-syncjulb-me

1.0.1

1 of 2 See more

git-configmap-sync julb-me 1.0.1

1 of the 2 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
julb/kubernetes-configmap-sync :1.1.0	d7d8836366ad	pip@20.2.4	25.3

Open the chart page →

2,618

vmware-exporterkremers

2.3.0

1 of 1 See more

vmware-exporter kremers 2.3.0

1 of the 1 container images this version deploys carry CVE-2025-8869.

Container image	Digest	Package	Fixed in
pryorda/vmware_exporter :v0.18.4	79925e63e59f	pip@22.0.4	25.3

Open the chart page →

1,180

Container images carrying it

1,131 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
dbanda/livy :0.8	0ca125e68e53	pip@20.1.1	25.3	1
dbanda/spark :2.4.6	d0e6367876ae	pip@20.1.1	25.3	1
dchesterton/amcrest2mqtt :1.0.9	cc70f2238aa9	pip@21.2.3	25.3	1
ddosify/selfhosted_alaz_backend :1.0.6	a43c5155fa1c	pip@24.0	25.3	1
ddosify/selfhosted_alaz_backend :2.3.11	e5be48b37348	pip@24.0	25.3	1
ddosify/selfhosted_backend :3.2.9	3c11e3182652	pip@24.0	25.3	1
ddosify/selfhosted_backend :2.6.11	ac323d52bfb4	pip@24.0	25.3	1
ddosify/selfhosted_hammermanager :1.2.4	71b8768f49bc	pip@22.0.4	25.3	1
ddosify/selfhosted_hammermanager :2.0.2	b796b8c73011	pip@24.0	25.3	1
deepflowce/deepflow-app :v6.2.6.5	a1888d35e787	pip@22.0.4	25.3	1
dellemc/csm-application-mobility-controller :v0.1.0	148ada9060a9	pip@9.0.3	25.3	1
devopsgoofy/k8s-platform :latest	ad865312099f	pip@24.3.1	25.3	1
devopshq/artifactory-cleanup :1.0.18	30e093bffa91	pip@23.0.1	25.3	1
devopstales/kubedash :3.1.0	8bb837da5aec	pip@24.0	25.3	1
devopstales/kube-openid-connector :1.0	42c40a0e9f1b	pip@22.0.4	25.3	1
devopstales/trivy-operator :2.5	75136aa7a26e	pip@22.0.4	25.3	1
dgtlmoon/sockpuppetbrowser :latest	f166a963b550	pip@24.0	25.3	1
dinutac/jinja2docker :2.1.8	9340dde8a8a4	pip@23.3.1	25.3	1
djjudas21/alertify :0.1.0	ba22be670c37	pip@25.0.1	25.3	1
djjudas21/autonodelabel :0.0.6	f17233350c4f	pip@23.1.2	25.3	1
djjudas21/ecowitt-exporter :2.2.0	73aab45ef10d	pip@25.0.1	25.3	1
djjudas21/liturgical-colour-app :0.7.2	954935971d42	pip@25.0.1	25.3	1
djjudas21/nova-exporter :0.0.10	e9094580885c	pip@25.0.1	25.3	1
dnationcloud/kubernetes-linter :0.2.1	dee6376560f5	pip@18.1	25.3	1
dockerid31415926/pod-pvc-mapping :v0.1.3	354309669f16	pip@21.2.4	25.3	1
dockerid31415926/pvc-exporter :v0.1.3	5a1dd17e0e07	pip@21.2.4	25.3	1
dongjiang1989/lxcfs :v6.0.3	4bf9ae391948	pip@20.0.2 python-pip@20.0.2-5ubuntu1.11	25.3 no fix listed	1
douz/helpdesk :latest	4384103d0219	pip@22.0.4	25.3	1
dpage/pgadmin4 :8.4	18cd5711fc9a	pip@23.3.1	25.3	1
dpage/pgadmin4 :7.5	37946e4f3e7b	pip@23.1.2	25.3	1
dpage/pgadmin4 :9.2	52cb72a9e3da	pip@24.3.1	25.3	1
dpage/pgadmin4 :8.13	561c1f8f99f2	pip@24.0	25.3	1
dpage/pgadmin4 :4.5	a5a656e1d5fd	pip@19.0.3	25.3	1
dpage/pgadmin4 :4.22	b1f00b8163cf	pip@20.1.1	25.3	1
drgrove/mtls-server :v0.14.2	361721759a2b	pip@19.1.1	25.3	1
dserio83/velero-api :0.3.1	6b3d9115fee2	pip@25.1.1 python-pip@23.0.1+dfsg-1	25.3 no fix listed	1
dserio83/velero-watchdog :0.1.8	d5deae589229	pip@23.0.1	25.3	1
dysnix/pritunl :v1.29-r8	19951e3e7a32	pip@20.2.2	25.3	1
eclipseaerios/aerios-k8s-shim :v1.0.0	d4ed3d8e5db4	pip@23.0.1	25.3	1
eclipseaerios/hlo-allocator :v3.0.0	3cc1d94cfe96	pip@23.0.1	25.3	1
eclipseaerios/hlo-data-aggregator :v3.0.0	b433c2b9f5dc	pip@23.0.1	25.3	1
eclipseaerios/hlo-deployment-engine :v3.0.0	d582d39208c7	pip@23.0.1	25.3	1
eclipseaerios/hlo-fe-engine :v3.0.0	8ed2df4ca692	pip@23.0.1	25.3	1
eclipseaerios/iota-messages-api :latest	e7f5ba0bc64d	pip@23.0.1	25.3	1
eclipseaerios/self-awareness-hardware-info :1.4.4	34b72f45b46a	pip@25.2	25.3	1
eclipseaerios/self-awareness-power-consumption :1.3.3	c8af377c709f	pip@25.2	25.3	1
eclipseaerios/trust-manager :1.0.0	f55442e2c0ed	pip@23.0.1	25.3	1
elastichq/elasticsearch-hq :latest	bb3bd22c2b87	pip@18.1	25.3	1
elautoestopista/aeneabot :4.2.1	125ba620d528	pip@25.0.1	25.3	1
elautoestopista/raponchi :0.3.0	b6f74db9fc81	pip@24.0	25.3	1