Skip to content
OpenAdvisories
High USN-7544-1 1 CVE

python-setuptools, setuptools vulnerability

Published May 28, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that setuptools did not properly sanitize paths. An
attacker could possibly use this issue to write files to arbitrary
locations on the filesystem.

Fixed packages 8

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS setuptools 45.2.0-1ubuntu0.3
Ubuntu · 22.04 LTS 22.04:LTS setuptools 59.6.0-1.2ubuntu0.22.04.3
Ubuntu · 24.04 LTS 24.04:LTS setuptools 68.1.2-2ubuntu1.2
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS python-setuptools 3.3-1ubuntu2+esm3
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS python-setuptools 20.7.0-1ubuntu0.1~esm3
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS python-setuptools 39.0.1-2ubuntu0.1+esm2
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-setuptools 44.0.0-2ubuntu0.1+esm2
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS python-setuptools 44.1.1-1.2ubuntu0.22.04.1+esm2

Vulnerabilities 1

  • High 7.7
    CVE-2025-47273 Public exploit

    setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

    setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to ar…

    pypa setuptools kserve-storage-controller datadog-agent-7.77 Debian Ubuntu Azure Linux Wolfi PyPI

References

  • report
    https://ubuntu.com/security/CVE-2025-47273