CVE-2025-47273CWE-22

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

High · published May 17, 2025

CVSS v4.0
7.7
EPSS
2%
Percentile
75.5
In the wild
Unconfirmed
What it is

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.01592 · 75.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-05-17T15:46Z
EPSS history
Timeline
  • 17 MAY 15:46Z
    setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
    cvelistv5