CVE-2025-47273
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
02 Description
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
03 Exploitation and scoring
- Exploitation
- Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.
- SSVC decision
- ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
- AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
- Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
- EPSS probability
- 1.59% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 75.5% of scored records. A rank, not a probability.
- NVD base score
- 7.7 (CVSS v4.0), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVD analysis status
- Analyzed. NVD last modified this record on 2026-06-17.
- Red Hat severity
- Moderate. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2025-05-17 15:46Z1 YR AGO
- Last updated
- 2025-05-28 15:03Z1 YR AGO
- Reserved
- 2025-05-05
- Assigning CNA
- GitHub_M
- Record state
- PUBLISHED
- Severity
- High (CVSS 7.7)
- CNA CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
- Weaknesses
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Base
- Data version
- 5.1
- Document digest
- 4c85bd7e1a58a5009541e3d7661fa9fccf7d26fdfb8f528fddf1b016c3e5ba47
05 Affected products
06 References
- github.comhttps://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf
- github.comhttps://github.com/pypa/setuptools/issues/4946
- github.comhttps://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
- github.comhttps://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/05/msg00035.html
07 Fixed in
AlmaLinux 8
- platform-python-setuptools Fixed in 39.2.0-9.el8_10
- python3-setuptools Fixed in 39.2.0-9.el8_10
- python3-setuptools-wheel Fixed in 39.2.0-9.el8_10
- python3.11-setuptools Fixed in 65.5.1-4.el8_10
- python3.11-setuptools-wheel Fixed in 65.5.1-4.el8_10
- python3.12-setuptools-wheel Fixed in 68.2.2-5.el8_10
- python39 Fixed in 3.9.20-2.module_el8.10.0+4040+9207bbc0
- python39-Cython Fixed
A version is affected if any line below covers it.
- Affected before 0.29.21-5.module_el8.6.0+2780+a40f65e1
- Affected before 0.29.21-5.module_el8.6.0+3248+c431e88c
- python39-PyMySQL Fixed in 0.10.1-2.module_el8.6.0+2780+a40f65e1
- python39-attrs Fixed in 20.3.0-2.module_el8.6.0+2780+a40f65e1
- python39-cffi Fixed
A version is affected if any line below covers it.
- Affected before 1.14.3-2.module_el8.6.0+2780+a40f65e1
- Affected before 1.14.3-2.module_el8.6.0+3248+c431e88c
- python39-chardet Fixed in 3.0.4-19.module_el8.6.0+2780+a40f65e1
- python39-cryptography Fixed in 3.3.1-3.module_el8.10.0+3765+2f9a457d
- python39-debug Fixed in 3.9.20-2.module_el8.10.0+4040+9207bbc0
- python39-devel Fixed in 3.9.20-2.module_el8.10.0+4040+9207bbc0
- python39-idle Fixed in 3.9.20-2.module_el8.10.0+4040+9207bbc0
- python39-idna Fixed in 2.10-4.module_el8.10.0+3849+a48d89aa
- python39-iniconfig Fixed in 1.1.1-2.module_el8.6.0+2780+a40f65e1
- python39-libs Fixed in 3.9.20-2.module_el8.10.0+4040+9207bbc0
- python39-lxml Fixed
A version is affected if any line below covers it.
- Affected before 4.6.5-1.module_el8.6.0+2780+a40f65e1
- Affected before 4.6.5-1.module_el8.6.0+3248+c431e88c
- python39-mod_wsgi Fixed in 4.7.1-7.module_el8.10.0+3989+a618fe15.1
- python39-more-itertools Fixed in 8.5.0-2.module_el8.6.0+2780+a40f65e1
- python39-numpy Fixed
A version is affected if any line below covers it.
- Affected before 1.19.4-3.module_el8.6.0+2780+a40f65e1
- Affected before 1.19.4-3.module_el8.6.0+3248+c431e88c
- python39-numpy-doc Fixed in 1.19.4-3.module_el8.6.0+2780+a40f65e1
- python39-numpy-f2py Fixed
A version is affected if any line below covers it.
- Affected before 1.19.4-3.module_el8.6.0+2780+a40f65e1
- Affected before 1.19.4-3.module_el8.6.0+3248+c431e88c
- python39-packaging Fixed in 20.4-4.module_el8.6.0+2780+a40f65e1
- python39-pip Fixed in 20.2.4-9.module_el8.10.0+3765+2f9a457d
- python39-pip-wheel Fixed in 20.2.4-9.module_el8.10.0+3765+2f9a457d
- python39-pluggy Fixed in 0.13.1-3.module_el8.6.0+2780+a40f65e1
- python39-ply Fixed in 3.11-10.module_el8.6.0+2780+a40f65e1
- python39-psutil Fixed
A version is affected if any line below covers it.
- Affected before 5.8.0-4.module_el8.6.0+2780+a40f65e1
- Affected before 5.8.0-4.module_el8.6.0+3248+c431e88c
- python39-psycopg2 Fixed in 2.8.6-3.module_el8.10.0+3765+2f9a457d
- python39-psycopg2-doc Fixed in 2.8.6-3.module_el8.10.0+3765+2f9a457d
- python39-psycopg2-tests Fixed in 2.8.6-3.module_el8.10.0+3765+2f9a457d
- python39-py Fixed in 1.10.0-1.module_el8.6.0+2780+a40f65e1
- python39-pybind11 Fixed
A version is affected if any line below covers it.
- Affected before 2.7.1-1.module_el8.6.0+2780+a40f65e1
- Affected before 2.7.1-1.module_el8.6.0+3248+c431e88c
- python39-pybind11-devel Fixed
A version is affected if any line below covers it.
- Affected before 2.7.1-1.module_el8.6.0+2780+a40f65e1
- Affected before 2.7.1-1.module_el8.6.0+3248+c431e88c
- python39-pycparser Fixed in 2.20-3.module_el8.6.0+2780+a40f65e1
- python39-pyparsing Fixed in 2.4.7-5.module_el8.6.0+2780+a40f65e1
- python39-pysocks Fixed in 1.7.1-4.module_el8.6.0+2780+a40f65e1
15 further packages in AlmaLinux 8 not shown (first 40 listed).
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
AlmaLinux 9
- fence-agents-aliyun Fixed in 4.10.0-86.el9_6.7
- fence-agents-all Fixed in 4.10.0-86.el9_6.7
- fence-agents-amt-ws Fixed in 4.10.0-86.el9_6.7
- fence-agents-apc Fixed in 4.10.0-86.el9_6.7
- fence-agents-apc-snmp Fixed in 4.10.0-86.el9_6.7
- fence-agents-aws Fixed in 4.10.0-86.el9_6.7
- fence-agents-azure-arm Fixed in 4.10.0-86.el9_6.7
- fence-agents-bladecenter Fixed in 4.10.0-86.el9_6.7
- fence-agents-brocade Fixed in 4.10.0-86.el9_6.7
- fence-agents-cisco-mds Fixed in 4.10.0-86.el9_6.7
- fence-agents-cisco-ucs Fixed in 4.10.0-86.el9_6.7
- fence-agents-common Fixed in 4.10.0-86.el9_6.7
- fence-agents-compute Fixed in 4.10.0-86.el9_6.7
- fence-agents-drac5 Fixed in 4.10.0-86.el9_6.7
- fence-agents-eaton-snmp Fixed in 4.10.0-86.el9_6.7
- fence-agents-emerson Fixed in 4.10.0-86.el9_6.7
- fence-agents-eps Fixed in 4.10.0-86.el9_6.7
- fence-agents-gce Fixed in 4.10.0-86.el9_6.7
- fence-agents-heuristics-ping Fixed in 4.10.0-86.el9_6.7
- fence-agents-hpblade Fixed in 4.10.0-86.el9_6.7
- fence-agents-ibm-powervs Fixed in 4.10.0-86.el9_6.7
- fence-agents-ibm-vpc Fixed in 4.10.0-86.el9_6.7
- fence-agents-ibmblade Fixed in 4.10.0-86.el9_6.7
- fence-agents-ifmib Fixed in 4.10.0-86.el9_6.7
- fence-agents-ilo-moonshot Fixed in 4.10.0-86.el9_6.7
- fence-agents-ilo-mp Fixed in 4.10.0-86.el9_6.7
- fence-agents-ilo-ssh Fixed in 4.10.0-86.el9_6.7
- fence-agents-ilo2 Fixed in 4.10.0-86.el9_6.7
- fence-agents-intelmodular Fixed in 4.10.0-86.el9_6.7
- fence-agents-ipdu Fixed in 4.10.0-86.el9_6.7
- fence-agents-ipmilan Fixed in 4.10.0-86.el9_6.7
- fence-agents-kdump Fixed in 4.10.0-86.el9_6.7
- fence-agents-kubevirt Fixed in 4.10.0-86.el9_6.7
- fence-agents-lpar Fixed in 4.10.0-86.el9_6.7
- fence-agents-mpath Fixed in 4.10.0-86.el9_6.7
- fence-agents-openstack Fixed in 4.10.0-86.el9_6.7
- fence-agents-redfish Fixed in 4.10.0-86.el9_6.7
- fence-agents-rhevm Fixed in 4.10.0-86.el9_6.7
- fence-agents-rsa Fixed in 4.10.0-86.el9_6.7
- fence-agents-rsb Fixed in 4.10.0-86.el9_6.7
21 further packages in AlmaLinux 9 not shown (first 40 listed).
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
AlmaLinux 10
- python3-setuptools Fixed in 69.0.3-12.el10_0
- python3-setuptools-wheel Fixed in 69.0.3-12.el10_0
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 8
- platform-python-setuptools Fixed in 39.2.0-9.el8_10
- python3-setuptools Fixed in 39.2.0-9.el8_10
- python3-setuptools-wheel Fixed in 39.2.0-9.el8_10
- python3.11-setuptools Fixed in 65.5.1-4.el8_10
- python3.11-setuptools-wheel Fixed in 65.5.1-4.el8_10
- python3.12-setuptools-wheel Fixed in 68.2.2-5.el8_10
- python39 Fixed in 3.9.20-2.module_el8.10.0+4040+9207bbc0
- python39-Cython Fixed
A version is affected if any line below covers it.
- Affected before 0.29.21-5.module_el8.6.0+2780+a40f65e1
- Affected before 0.29.21-5.module_el8.6.0+3248+c431e88c
- python39-PyMySQL Fixed in 0.10.1-2.module_el8.6.0+2780+a40f65e1
- python39-attrs Fixed in 20.3.0-2.module_el8.6.0+2780+a40f65e1
- python39-cffi Fixed
A version is affected if any line below covers it.
- Affected before 1.14.3-2.module_el8.6.0+2780+a40f65e1
- Affected before 1.14.3-2.module_el8.6.0+3248+c431e88c
- python39-chardet Fixed in 3.0.4-19.module_el8.6.0+2780+a40f65e1
- python39-cryptography Fixed in 3.3.1-3.module_el8.10.0+3765+2f9a457d
- python39-debug Fixed in 3.9.20-2.module_el8.10.0+4040+9207bbc0
- python39-devel Fixed in 3.9.20-2.module_el8.10.0+4040+9207bbc0
- python39-idle Fixed in 3.9.20-2.module_el8.10.0+4040+9207bbc0
- python39-idna Fixed in 2.10-4.module_el8.10.0+3849+a48d89aa
- python39-iniconfig Fixed in 1.1.1-2.module_el8.6.0+2780+a40f65e1
- python39-libs Fixed in 3.9.20-2.module_el8.10.0+4040+9207bbc0
- python39-lxml Fixed
A version is affected if any line below covers it.
- Affected before 4.6.5-1.module_el8.6.0+2780+a40f65e1
- Affected before 4.6.5-1.module_el8.6.0+3248+c431e88c
- python39-mod_wsgi Fixed in 4.7.1-7.module_el8.10.0+3989+a618fe15.1
- python39-more-itertools Fixed in 8.5.0-2.module_el8.6.0+2780+a40f65e1
- python39-numpy Fixed
A version is affected if any line below covers it.
- Affected before 1.19.4-3.module_el8.6.0+2780+a40f65e1
- Affected before 1.19.4-3.module_el8.6.0+3248+c431e88c
- python39-numpy-doc Fixed in 1.19.4-3.module_el8.6.0+2780+a40f65e1
- python39-numpy-f2py Fixed
A version is affected if any line below covers it.
- Affected before 1.19.4-3.module_el8.6.0+2780+a40f65e1
- Affected before 1.19.4-3.module_el8.6.0+3248+c431e88c
- python39-packaging Fixed in 20.4-4.module_el8.6.0+2780+a40f65e1
- python39-pip Fixed in 20.2.4-9.module_el8.10.0+3765+2f9a457d
- python39-pip-wheel Fixed in 20.2.4-9.module_el8.10.0+3765+2f9a457d
- python39-pluggy Fixed in 0.13.1-3.module_el8.6.0+2780+a40f65e1
- python39-ply Fixed in 3.11-10.module_el8.6.0+2780+a40f65e1
- python39-psutil Fixed
A version is affected if any line below covers it.
- Affected before 5.8.0-4.module_el8.6.0+2780+a40f65e1
- Affected before 5.8.0-4.module_el8.6.0+3248+c431e88c
- python39-psycopg2 Fixed in 2.8.6-3.module_el8.10.0+3765+2f9a457d
- python39-psycopg2-doc Fixed in 2.8.6-3.module_el8.10.0+3765+2f9a457d
- python39-psycopg2-tests Fixed in 2.8.6-3.module_el8.10.0+3765+2f9a457d
- python39-py Fixed in 1.10.0-1.module_el8.6.0+2780+a40f65e1
- python39-pybind11 Fixed
A version is affected if any line below covers it.
- Affected before 2.7.1-1.module_el8.6.0+2780+a40f65e1
- Affected before 2.7.1-1.module_el8.6.0+3248+c431e88c
- python39-pybind11-devel Fixed
A version is affected if any line below covers it.
- Affected before 2.7.1-1.module_el8.6.0+2780+a40f65e1
- Affected before 2.7.1-1.module_el8.6.0+3248+c431e88c
- python39-pycparser Fixed in 2.20-3.module_el8.6.0+2780+a40f65e1
- python39-pyparsing Fixed in 2.4.7-5.module_el8.6.0+2780+a40f65e1
- python39-pysocks Fixed in 1.7.1-4.module_el8.6.0+2780+a40f65e1
15 further packages in CloudLinux 8 not shown (first 40 listed).
Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 9
- fence-agents-aliyun Fixed in 4.10.0-86.el9_6.7
- fence-agents-all Fixed in 4.10.0-86.el9_6.7
- fence-agents-amt-ws Fixed in 4.10.0-86.el9_6.7
- fence-agents-apc Fixed in 4.10.0-86.el9_6.7
- fence-agents-apc-snmp Fixed in 4.10.0-86.el9_6.7
- fence-agents-aws Fixed in 4.10.0-86.el9_6.7
- fence-agents-azure-arm Fixed in 4.10.0-86.el9_6.7
- fence-agents-bladecenter Fixed in 4.10.0-86.el9_6.7
- fence-agents-brocade Fixed in 4.10.0-86.el9_6.7
- fence-agents-cisco-mds Fixed in 4.10.0-86.el9_6.7
- fence-agents-cisco-ucs Fixed in 4.10.0-86.el9_6.7
- fence-agents-common Fixed in 4.10.0-86.el9_6.7
- fence-agents-compute Fixed in 4.10.0-86.el9_6.7
- fence-agents-drac5 Fixed in 4.10.0-86.el9_6.7
- fence-agents-eaton-snmp Fixed in 4.10.0-86.el9_6.7
- fence-agents-emerson Fixed in 4.10.0-86.el9_6.7
- fence-agents-eps Fixed in 4.10.0-86.el9_6.7
- fence-agents-gce Fixed in 4.10.0-86.el9_6.7
- fence-agents-heuristics-ping Fixed in 4.10.0-86.el9_6.7
- fence-agents-hpblade Fixed in 4.10.0-86.el9_6.7
- fence-agents-ibm-powervs Fixed in 4.10.0-86.el9_6.7
- fence-agents-ibm-vpc Fixed in 4.10.0-86.el9_6.7
- fence-agents-ibmblade Fixed in 4.10.0-86.el9_6.7
- fence-agents-ifmib Fixed in 4.10.0-86.el9_6.7
- fence-agents-ilo-moonshot Fixed in 4.10.0-86.el9_6.7
- fence-agents-ilo-mp Fixed in 4.10.0-86.el9_6.7
- fence-agents-ilo-ssh Fixed in 4.10.0-86.el9_6.7
- fence-agents-ilo2 Fixed in 4.10.0-86.el9_6.7
- fence-agents-intelmodular Fixed in 4.10.0-86.el9_6.7
- fence-agents-ipdu Fixed in 4.10.0-86.el9_6.7
- fence-agents-ipmilan Fixed in 4.10.0-86.el9_6.7
- fence-agents-kdump Fixed in 4.10.0-86.el9_6.7
- fence-agents-kubevirt Fixed in 4.10.0-86.el9_6.7
- fence-agents-lpar Fixed in 4.10.0-86.el9_6.7
- fence-agents-mpath Fixed in 4.10.0-86.el9_6.7
- fence-agents-openstack Fixed in 4.10.0-86.el9_6.7
- fence-agents-redfish Fixed in 4.10.0-86.el9_6.7
- fence-agents-rhevm Fixed in 4.10.0-86.el9_6.7
- fence-agents-rsa Fixed in 4.10.0-86.el9_6.7
- fence-agents-rsb Fixed in 4.10.0-86.el9_6.7
21 further packages in CloudLinux 9 not shown (first 40 listed).
Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 10
- python3-setuptools Fixed in 69.0.3-12.el10_0
- python3-setuptools-wheel Fixed in 69.0.3-12.el10_0
Derived from AlmaLinux 10. Partial coverage: only packages taken from AlmaLinux 10 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Debian 12
- setuptools Fixed in 66.1.1-1+deb12u2
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- setuptools Fixed in 78.1.1-0.1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- setuptools Fixed in 78.1.1-0.1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 20.04 LTS
- setuptools Fixed in 45.2.0-1ubuntu0.3
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 22.04 LTS
- setuptools Fixed in 59.6.0-1.2ubuntu0.22.04.3
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 24.04 LTS
- setuptools Fixed in 68.1.2-2ubuntu1.2
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 14.04 LTS
- python-pip No fix yet
- python-setuptools Fixed in 3.3-1ubuntu2+esm3Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 16.04 LTS
- python-pip Fixed in 8.1.1-2ubuntu0.6+esm12Available with Ubuntu Pro: https://ubuntu.com/pro
- python-setuptools Fixed in 20.7.0-1ubuntu0.1~esm3Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 18.04 LTS
- python-pip Fixed in 9.0.1-2.3~ubuntu1.18.04.8+esm8Available with Ubuntu Pro: https://ubuntu.com/pro
- python-setuptools Fixed in 39.0.1-2ubuntu0.1+esm2Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 22.04 LTS
- python-setuptools Fixed in 44.1.1-1.2ubuntu0.22.04.1+esm2Available with Ubuntu Pro: https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.