CVE-2026-104843
MediumAdvisory
Published 5 Oct 2026In the index since 6 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.9
- base score, highest
- EPSS
- 0.004
- 35th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 15
- of 18,035 indexed, latest versions
- Container images
- 12
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
uv: Path traversal on Windows through wheel extraction
Carried by container images the latest versions of 15 of 18,035 indexed charts deploy, on 12 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| uvcargo | 0.12.7, 0.12.8, 0.12.9, 0.12.10+4 more | 0.12.18 | 11 |
| uvpypi | 0.12.7, 0.12.8, 0.12.10, 0.12.12+2 more | 0.12.18 | 8 |
- OSV records
- GHSA-2cv4-cqwr-gwf7
Charts affected
15 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| datahubdatahubVerified publisher | 1.1.6 | 1 of 4See more | 1,486 |
| prefect-serverprefectVerified publisher | 2026.10.6163015 | 1 of 2See more | 5,969 |
| paperless-ngxpaperless-ngxVerified publisher | 0.3.23 | 1 of 3See more | 9,020 |
| paperlesszekker6Verified publisher | 11.10.0 | 1 of 1See more | 4,924 |
| music-assistantbdclark-helm-chartsVerified publisher | 0.4.13 | 1 of 1See more | 4,548 |
| csghubcsghubVerified publisher | 2.5.0 | 1 of 34See more | 59,100 |
| supersetdeliveryheroVerified publisher | 1.1.3 | 1 of 1See more | 2,695 |
| difydify | 1.0.0 | 1 of 4See more | 56,729 |
| supersethelm-charts-nr | 1.1.3 | 1 of 1See more | 2,695 |
| archiveboxhelmforgeVerified publisher | 1.1.13 | 1 of 1See more | 5,809 |
| chiefonboardinghelmforgeVerified publisher | 1.1.15 | 1 of 3See more | 8,103 |
| supersethelmforgeVerified publisher | 1.3.8 | 1 of 5See more | 5,978 |
| parcelapp-mcpobeoneVerified publisher | 0.1.0 | 1 of 1See more | 1,230 |
| osdfir-infrastructureosdfir-infrastructureVerified publisher | 2.15.0 | 1 of 40See more | 235,082 |
| yetiosdfir-infrastructureVerified publisher | 1.0.5 | 1 of 4See more | 8,085 |
Container images carrying it
12 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| apache/ | 16b50bbef664 | uv uv | 0.12.18 0.12.18 | 3 |
| ghcr.io/ | 5fa76604a81d | uv | 0.12.18 | 2 |
| acryldata/ | c5fd70130157 | uv | 0.12.18 | 1 |
| archivebox/ | 8c21bb233130 | uv | 0.12.18 | 1 |
| chiefonboarding/ | d0964135ea82 | uv uv | 0.12.18 0.12.18 | 1 |
| langgenius/ | 7d2fb04baf44 | uv uv | 0.12.18 0.12.18 | 1 |
| opencsghq/ | 7d0271e26521 | uv uv | 0.12.18 0.12.18 | 1 |
| prefecthq/ | 19463f92420b | uv | 0.12.18 | 1 |
| yetiplatform/ | 9bcbe2650a14 | uv uv | 0.12.18 0.12.18 | 1 |
| yetiplatform/ | 9c3006cedcca | uv uv | 0.12.18 0.12.18 | 1 |
| ghcr.io/ | 885872224fa5 | uv uv | 0.12.18 0.12.18 | 1 |
| ghcr.io/ | 7073131db60b | uv | 0.12.18 | 1 |