setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
Summary
A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1
Details
def _download_url(self, url, tmpdir):
# Determine download filename
#
name, _fragment = egg_info_for_url(url)
if name:
while '..' in name:
name = name.replace('..', '.').replace('\\', '_')
else:
name = "__downloaded__" # default if URL has no path contents
if name.endswith('.[egg.zip](http://egg.zip/)'):
name = name[:-4] # strip the extra .zip before download
--> filename = os.path.join(tmpdir, name)os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter.
name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient.
Risk Assessment
As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like https://github.com/advisories/GHSA-r9hx-vwmv-q579, and as described by POC 4 in https://github.com/advisories/GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.
Impact
An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
References
https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 https://github.com/pypa/setuptools/issues/4946
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | setuptools | < 78.1.1 | 78.1.1 |
Referencias
- https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf
- https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html
- https://github.com/pypa/setuptools/issues/4946
- https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
- https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
- https://nvd.nist.gov/vuln/detail/CVE-2025-47273
- https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml
- https://github.com/pypa/setuptools
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P- Debilidad (CWE)
CWE-22- Plataforma
- Python (PyPI)
- Paquete
setuptools- Publicada
- 17.05.2025
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2025-49 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-5rjg-fvgr-3xxf - CC BY 4.0
Historial de vulnerabilidades: setuptools
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 5
- Primera → última
- 08.2013 07.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 4
- Media 1
Divulgaciones por año
- 2017: 0
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 1
- 2026: 1
antes: 1
-
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.