CVE-2025-47273: Setuptools Path Traversal Vulnerability Leading to Arbitrary File Write
Summary
CVE-2025-47273: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Affects setuptools versions < 78.1.1. Fixed in 78.1.1. How to fix ↓
Also tracked for
- setuptools · PyPI
- setuptools · Debian:11
- setuptools · PyPI
The same CVE-2025-47273 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Setuptools is a widely used Python package that facilitates the downloading, building, installation, upgrading, and uninstallation of Python packages. It streamlines package management for Python developers, allowing them to easily manage dependencies and package distributions. However, prior to version 78.1.1, Setuptools contained a critical path traversal vulnerability in the PackageIndex.download function, which could be exploited by attackers.
Vulnerability Detail
The vulnerability in Setuptools arises from a path traversal flaw in the PackageIndex component, which allows an attacker to manipulate file paths and write files to arbitrary locations on the filesystem. This occurs with the permissions of the process executing the Python code, potentially leading to unauthorized access and remote code execution. The issue affects all versions of Setuptools prior to 78.1.1, making it a significant risk for applications relying on this package.
How To Fix
Minimum fixed version
78.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict the permissions of the process running the Python code to limit the potential impact of the vulnerability. However, the most effective solution is to update to the patched version.
Conclusion
The path traversal vulnerability in Setuptools (CVE-2025-47273) poses a significant risk, allowing attackers to write files to arbitrary locations. It is crucial for developers to update to version 78.1.1 or later to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for setuptools →
FAQ
The vulnerability is a path traversal issue that allows arbitrary file writing on the filesystem.
All versions of Setuptools prior to 78.1.1 are affected by this vulnerability.
An attacker could write files to arbitrary locations, potentially leading to remote code execution depending on the context.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for setuptools.
