Read the docs
TI-2025-23836 Aliases CVE-2025-32799

Conda-build Vulnerable to Path Traversal via Malicious Tar File

Priority MEDIUM 58CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal (Tarslip) attacks due to improper sanitization of tar entry paths. Attackers can craft tar archives containing entries with directory traversal sequences to write files outside the intended extraction directory. This could lead to arbitrary file overwrites, privilege escalation, or code execution if sensitive locations are targeted. This issue has been patched in version 25.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0133 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed conda-build (conda): 25.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
condaconda-buildbefore 25.4.025.4.0Patch availableCNA
  • conda-build Vendorconda Affected before 25.4.0 Fixed in 25.4.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:anaconda:conda-build:*:*:*:*:*:*:*:*before 25.4.0VulnerableAnaconda
  • cpe:2.3:a:anaconda:conda-build:*:*:*:*:*:*:*:* Versions before 25.4.0 Vulnerable ·Anaconda

Remediation

  • Fix · CNA conda-build (conda) Fixed in 25.4.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32799

References

Exploit 1

Patch 1

Other 2

  • TI-2026-38909 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation CVSS 3.1HIGH 8.8
  • TI-2025-23835 Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectors CVSS 4.0HIGH 8.2
  • TI-2026-79928 Pwn request in Conda infrastructure workflow exposes SYNC_TOKEN CVSS 3.1CRITICAL 9.9
  • TI-2025-39776 (conda) Constructor: Excessive permissions during and after installation CVSS 3.1HIGH 7.8
  • TI-2025-23837 Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI CVSS 4.0HIGH 7.2
  • TI-2024-30877 Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation… CVSS 3.1HIGH 7.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences