CoreCVE
Back

HIGH

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Published May 17, 2025

Description

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.

Affected products

Remediation

Red Hat statement

Red Hat Product Security has rated this vulnerability "Moderate" based on the impact of the damage caused by a successful exploitation and the pre-requisites. * Exploitation requires that the attacker have limited code execution access to a Python environment where they can trigger the vulnerable PackageIndex.download() function—this might be via a script, plugin, or automated job. Full admin rights aren't needed but a user with no access at all will be unable to exploit this vulnerability. * The vulnerability impacts the integrity of the system within the same security boundary—it does not enable access or compromise across trust boundaries (e.g., from one container to another or from user space to kernel). * Successful exploitation only allows the attacker to "create" new files. The vulnerability does not provide access to existing files and by an extension to any confidential information. * Arbitrary file writes can overwrite critical config files, executables, or scripts. This can lead to persistent code execution, system misconfiguration, or unauthorized behavior, especially in automated environments. While overwriting critical files could theoretically lead to service disruption, the vulnerability in isolation does not inherently cause denial of service. The exploit doesn't target availability directly, and in many cases, systems may continue running.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-22

Path Traversal

References (12)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published May 17, 2025
Updated May 28, 2025
Reserved May 5, 2025
Link CVE-2025-47273
CISA Vulnrichment
Updated May 19, 2025
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2025-47273
Red Hat
Severity Moderate
Public date May 17, 2025
Links CVE-2025-47273 - Bugzilla
ENISA EUVD
Assigner GitHub_M
Published May 17, 2025
Updated May 28, 2025
Exploited since n/a
Link EUVD-2025-15591
EUVD-2025-15591 GHSA-5RJG-FVGR-3XXF