py-setuptools -- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

2026-05-14 · CVE-2025-47273 · VuXML entry

https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf reports: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process …

Affected versions

• py27-setuptools44, py310-setuptools58, py311-setuptools58, py312-setuptools58, py313-setuptools58, py313t-setuptools58, py314-setuptools58, py310-setuptools, py311-setuptools, py312-setuptools, py313-setuptools, py313t-setuptools, py314-setuptools < 78.1.1

By system

4 still vulnerable, 0 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.