PyPI: setuptools
CVE-2025-47273
Safety vulnerability ID: SFTY-20250517-45169
Safety legacy ID: pyup.io-76752
Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
Overview
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
Advisory
Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20250517-45169/CVE-2025-47273
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47273
- https://data.safetycli.com/changelogs/setuptools
- https://github.com/pypa/setuptools/issues/4946
- https://pypi.org/project/setuptools
- https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf
- https://nvd.nist.gov/vuln/detail/CVE-2025-47273
- https://github.com/pypa/setuptools/issues/4946
- https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
- https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
- https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html
- https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml
- https://github.com/advisories/GHSA-5rjg-fvgr-3xxf
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more