CVE-2025-47273 setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
Attackers can write files to arbitrary filesystem locations via path traversal in setuptools, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-47273?
CVE-2025-47273 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 17 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.
Weakness: CWE-22
Which versions are affected by CVE-2025-47273?
4 open source packages ship an affected version, including setuptools. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
setuptools Bitnami | All versions | 78.1.1 |
setuptools PyPI | All versions | 78.1.1 |
setuptools PyPI | All versions | 78.1.1 |
setuptools PyPI | All versions | 78.1.1 |
Linux distribution packages (36)
python3-setuptools AlmaLinux:10 | All versions | 69.0.3-12.el10_0 |
python3-setuptools-wheel AlmaLinux:10 | All versions | 69.0.3-12.el10_0 |
platform-python-setuptools AlmaLinux:8 | All versions | 39.2.0-9.el8_10 |
python3-setuptools AlmaLinux:8 | All versions | 39.2.0-9.el8_10 |
python3-setuptools-wheel AlmaLinux:8 | All versions | 39.2.0-9.el8_10 |
python3.11-setuptools AlmaLinux:8 | All versions | 65.5.1-4.el8_10 |
python3.11-setuptools-wheel AlmaLinux:8 | All versions | 65.5.1-4.el8_10 |
python3.12-setuptools-wheel AlmaLinux:8 | All versions | 68.2.2-5.el8_10 |
fence-agents-aliyun AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-all AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-amt-ws AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-apc AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-apc-snmp AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-aws AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-azure-arm AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-bladecenter AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-brocade AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-cisco-mds AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-cisco-ucs AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-common AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-compute AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-drac5 AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-eaton-snmp AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-emerson AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-eps AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-gce AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-heuristics-ping AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-hpblade AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-ibm-powervs AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-ibm-vpc AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-ibmblade AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-ifmib AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-ilo-moonshot AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-ilo-mp AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-ilo-ssh AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
fence-agents-ilo2 AlmaLinux:9 | All versions | 4.10.0-86.el9_6.7 |
Products include Debian Debian Linux, Python Setuptools.
How do I fix CVE-2025-47273?
Upgrade setuptools to 78.1.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-47273 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47273 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2025:10407, ALSA-2025:11036, ALSA-2025:11043, ALSA-2025:11044, ALSA-2025:11463, ALSA-2025:12834 and 95 more.