CVE-2025-47273 — Path Traversal in Setuptools
Severity
7.7HIGHNVD
EPSS
0.5%
top 34.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 17
Latest updateFeb 4
Description
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Packages10 packages
Also affects: Debian Linux 11.0
Patches
🔴Vulnerability Details
3OSV▶
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write↗2025-05-19
GHSA▶
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write↗2025-05-19
OSV▶
CVE-2025-47273: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages↗2025-05-17