Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
Python Setuptools Path Traversal Vulnerability
published 2 months ago
Summary
A security issue in Python Setuptools allows attackers to write files to any location on the computer. This could potentially lead to remote code execution, depending on the situation. Update to version 78.1.1 to fix the issue.
What to do
- Update openeuler python-setuptools to version 68.0.0-4.oe2403sp3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP3 | openeuler | python-setuptools |
< 68.0.0-4.oe2403sp3 Fix: upgrade to 68.0.0-4.oe2403sp3
|
Original advisory text
python-setuptools security update
Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages.
Security Fix(es):
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.(CVE-2025-47273)
Security Fix(es):
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.(CVE-2025-47273)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47273 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published13 Aug 2026
Updated16 Aug 2026
First seen16 Aug 2026
Sources
OESA-2026-3378 · OSV
Track software like this
Free during beta