CVE-2025-47273: setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
First published: Sat May 17 2025(Updated: )
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| setuptools | <78.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf
- https://github.com/pypa/setuptools/issues/4946
- https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
- https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
Frequently Asked Questions
What is the severity of CVE-2025-47273?
CVE-2025-47273 has a medium severity rating due to its path traversal vulnerability that can lead to arbitrary file writing.
How do I fix CVE-2025-47273?
To fix CVE-2025-47273, upgrade setuptools to version 78.1.1 or later.
What does CVE-2025-47273 affect?
CVE-2025-47273 affects setuptools versions prior to 78.1.1.
What is a path traversal vulnerability like in CVE-2025-47273?
A path traversal vulnerability like CVE-2025-47273 allows attackers to write files to arbitrary locations on the filesystem.
Who is responsible for the CVE-2025-47273 vulnerability?
The CVE-2025-47273 vulnerability is related to the setuptools package maintained by the Python Software Foundation.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/source
- agent/tags
- agent/severity
- agent/event
- vendor/python software foundation
- canonical/setuptools