CVE-2025-32799

Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal (Tarslip) attacks due to improper sanitization of tar entry paths. Attackers can craft tar archives containing entries with directory traversal sequences to write files outside the intended extraction directory. This could lead to arbitrary file overwrites, privilege escalation, or code execution if sensitive locations are targeted. This issue has been patched in version 25.4.0.

• CWE-22

• https://github.com/conda/conda-build/blob/834448b995eee02cf1c2e7ca97bcfa9affc77ee5/conda_build/convert.pyProduct
• https://github.com/conda/conda-build/blob/834448b995eee02cf1c2e7ca97bcfa9affc77ee5/conda_build/render.pyProduct
• https://github.com/conda/conda-build/commit/bdf5e0022cec9a0c1378cca3f2dc8c92b4834673Patch
• https://github.com/conda/conda-build/security/advisories/GHSA-h499-pxgj-qh5hExploit, Vendor Advisory
• https://github.com/conda/conda-build/security/advisories/GHSA-h499-pxgj-qh5hExploit, Vendor Advisory

Published

Jun 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32793Cilium is a networking, observability, and security solution…4
• CVE-2025-32794OpenEMR is a free and open source electronic health records …7.6
• CVE-2025-32795Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-32796Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-32797Conda-build contains commands and tools to build conda packa…7
• CVE-2025-32798Conda-build contains commands and tools to build conda packa…9.8
• CVE-2025-3280The ELEX WooCommerce Advanced Bulk Edit Products, Prices & A…6.5
• CVE-2025-32800Conda-build contains commands and tools to build conda packa…9.8
• CVE-2025-32801Kea configuration and API directives can be used to load a m…7.8
• CVE-2025-32802Kea configuration and API directives can be used to overwrit…6.1
• CVE-2025-32803In some cases, Kea log files or lease files may be world-rea…4
• CVE-2025-32807A path traversal vulnerability in FusionDirectory before 1.5…5.3