setuptools: Path Traversal Vulnerability in setuptools PackageIndex

🗓️ 12 Aug 2025 00:44:27Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

Path traversal vulnerability in setuptools lets writes outside the temp dir via crafted URLs; high integrity risk.

Reporter	Title	Published	Views	Family All 456
ibm	Security Bulletin: A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1, which affects IBM watsonx.data	1 Sep 202514:47	–	ibm
ibm	Security Bulletin: Astronomer with IBM is vulnerable to path traversal issues due to the setuptools package (CVE-2025-47273)	18 Nov 202519:12	–	ibm
ibm	Security Bulletin: Deserialization of untrusted data, path traversal, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	21 Jul 202516:17	–	ibm
ibm	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	11 Sep 202518:18	–	ibm
ibm	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Premium Cartridge	7 Apr 202620:13	–	ibm
ibm	Security Bulletin: IBM Fusion is vulnerable to Path Traversal due to python's setuptools (CVE-2025-47273)	1 Jul 202521:19	–	ibm
ibm	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in python3-setuptools python3-setuptools-wheel setuptools	29 Oct 202510:49	–	ibm
ibm	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	6 Jul 202610:21	–	ibm
ibm	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.2	21 Jun 202513:39	–	ibm
ibm	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in setuptools-70.3.0-py3-none-any.whl	22 Oct 202511:06	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9.4	any	python3.11-setuptools	0:65.5.1-2.el9_4.2.noarch	python3.11-setuptools-0:65.5.1-2.el9_4.2.noarch.noarch.rpm
Red Hat Enterprise Linux	9.4	any	python3.11-setuptools-wheel	0:65.5.1-2.el9_4.2.noarch	python3.11-setuptools-wheel-0:65.5.1-2.el9_4.2.noarch.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-47273
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py
github	www.github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
github	www.github.com/pypa/setuptools/issues/4946
github	www.github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-47273
cve	www.cve.org/CVERecord

30 Jun 2026 03:30Current

7.2High risk

Vulners AI Score7.2

CVSS 3.18.8

CVSS 48.7

EPSS0.01479

SSVC

setuptools path traversal temporary directory package index security vulnerability