Path Traversal in Pypa Setuptools
CVE-2025-47273
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (73.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 73.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: +0.000
Affected products
- Pypa Setuptools — versions < 78.1.1
- Python Setuptools
- Debian Linux — versions 11.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf (Exploit, Vendor Advisory)
- github.com/pypa/setuptools/issues/4946 (Exploit, Issue Tracking)
- github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b (Patch)
- github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setupt… (Product)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
Frequently asked questions
- What is CVE-2025-47273?
- CVE-2025-47273 is a high-severity vulnerability in Pypa Setuptools, classified under Path Traversal. CVSS score: 8.8/10. Published 2025-05-17.
- How severe is CVE-2025-47273?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2025-47273 known to be exploited?
- 18 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.