Path Traversal Vulnerability in setuptools Package Allows Arbitrary File Write
Summary
UBUNTU-CVE-2025-47273: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Affects python-pip versions 1.4.1-2 – 1.5.4-1ubuntu4+esm5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
setuptools is a widely used Python package that facilitates the downloading, building, installation, upgrading, and uninstallation of Python packages. It is essential for managing Python projects and dependencies, providing tools for package distribution and installation. However, a critical vulnerability has been identified in versions prior to 78.1.1, which could allow unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability stems from a path traversal issue in the PackageIndex component of setuptools. This flaw allows an attacker to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code. The implications of this vulnerability are severe, as it could lead to remote code execution, data loss, or system compromise, depending on the context in which the vulnerable code is executed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the execution of untrusted Python code or avoid using the vulnerable features of setuptools until the package is updated. Additionally, ensuring that the application runs with the least privileges can help minimize the impact of potential exploitation.
Conclusion
In summary, the path traversal vulnerability in setuptools poses significant risks to systems using versions prior to 78.1.1. Users are strongly advised to update to the latest version to protect against potential exploitation. Utilizing tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for python-pip →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The vulnerability could allow attackers to write files to arbitrary locations, potentially leading to remote code execution, data loss, or system compromise.
Yes, version 78.1.1 of setuptools addresses this vulnerability and should be installed to mitigate the risk.
If immediate updates are not possible, consider restricting the execution of untrusted Python code and running applications with the least privileges to minimize risk.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
