CVE-2025-47273

Public on 2025-05-17
Modified on 2025-06-02
Description

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.

Severity
Important
See what this means
CVSS v3 Base Score
7.5
See breakdown

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 2 - Core python-setuptools 2025-06-12 ALAS2-2025-2876
Amazon Linux 2023 python-setuptools 2025-06-10 ALAS2023-2025-1005
Amazon Linux 2 - Core python2-setuptools 2025-06-12 ALAS2-2025-2877
Amazon Linux 2023 python3.11-setuptools 2025-06-10 ALAS2023-2025-1003
Amazon Linux 2023 python3.12-setuptools 2025-06-10 ALAS2023-2025-1004

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD CVSSv3 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H