CVE-2025-47273

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.

CVSS

No CVSS.

References

Link	Resource
https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
https://github.com/pypa/setuptools/issues/4946
https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf
https://github.com/pypa/setuptools/issues/4946

Configurations

No configuration.

History

19 May 2025, 15:15

Type	Values Removed	Values Added
References	~~() https://github.com/pypa/setuptools/issues/4946 -~~	() https://github.com/pypa/setuptools/issues/4946 -

19 May 2025, 13:35

Type	Values Removed	Values Added
Summary		(es) setuptools es un paquete que permite a los usuarios descargar, compilar, instalar, actualizar y desinstalar paquetes de Python. Una vulnerabilidad de path traversal en `PackageIndex` está presente en setuptools anteriores a la versión 78.1.1. Un atacante podría escribir archivos en ubicaciones arbitrarias del sistema de archivos con los permisos del proceso que ejecuta el código Python, lo que podría escalar a la ejecución remota de código según el contexto. La versión 78.1.1 corrige el problema.

17 May 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-17 16:15

Updated : 2025-05-19 15:15

NVD link : CVE-2025-47273

Mitre link : CVE-2025-47273

CVE.ORG link : CVE-2025-47273

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-47273", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-05-17T16:15:19.110", "references": [{"url": "https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88", "source": "security-advisories@github.com"}, {"url": "https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b", "source": "security-advisories@github.com"}, {"url": "https://github.com/pypa/setuptools/issues/4946", "source": "security-advisories@github.com"}, {"url": "https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf", "source": "security-advisories@github.com"}, {"url": "https://github.com/pypa/setuptools/issues/4946", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue."}, {"lang": "es", "value": "setuptools es un paquete que permite a los usuarios descargar, compilar, instalar, actualizar y desinstalar paquetes de Python. Una vulnerabilidad de path traversal en `PackageIndex` est\u00e1 presente en setuptools anteriores a la versi\u00f3n 78.1.1. Un atacante podr\u00eda escribir archivos en ubicaciones arbitrarias del sistema de archivos con los permisos del proceso que ejecuta el c\u00f3digo Python, lo que podr\u00eda escalar a la ejecuci\u00f3n remota de c\u00f3digo seg\u00fan el contexto. La versi\u00f3n 78.1.1 corrige el problema."}], "lastModified": "2025-05-19T15:15:24.163", "sourceIdentifier": "security-advisories@github.com"}