https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:04:23 +0000 https://db.gcve.eu/vuln/ghsa-5rjg-fvgr-3xxf <p><strong>Affected:</strong> PyPI: setuptools</p> <p>### Summary A path traversal vulnerability in `PackageIndex` was fixed in setuptools version 78.1.1</p> <p>### Details ``` def _download_url(self, url, tmpdir): # Determine download filename # name, _fragment = egg_info_for_url(url) if name: while &#39;..&#39; in name: name = name.replace(&#39;..&#39;, &#39;.&#39;).replace(&#39;\\&#39;, &#39;_&#39;) else: name = &#34;__downloaded__&#34; # default if URL has no path contents</p> <p>if name.endswith(&#39;.[egg.zip](http://egg.zip/)&#39;): name = name[:-4] # strip the extra .zip before download</p> <p>--&gt; filename = os.path.join(tmpdir, name) ```</p> <p>Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88</p> <p>`os.path.join()` discards the first argument `tmpdir` if the second begins with a slash or drive letter. `name` is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of &#39;..&#39; with &#39;.&#39;, it is insufficient.</p> <p>### Risk Assessment As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like https://github.com/advisories/GHSA-r9hx-vwmv-q579, and as described by POC 4 in https://github.com/advisories/GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.</p> <p>### Impact An attacker would be allowed to write files to arbitrary locations on th…</p> <p><strong>Affected:</strong> PyPI: setuptools</p> <p>### Summary A path traversal vulnerability in `PackageIndex` was fixed in setuptools version 78.1.1</p> <p>### Details ``` def _download_url(self, url, tmpdir): # Determine download filename # name, _fragment = egg_info_for_url(url) if name: while &#39;..&#39; in name: name = name.replace(&#39;..&#39;, &#39;.&#39;).replace(&#39;\\&#39;, &#39;_&#39;) else: name = &#34;__downloaded__&#34; # default if URL has no path contents</p> <p>if name.endswith(&#39;.[egg.zip](http://egg.zip/)&#39;): name = name[:-4] # strip the extra .zip before download</p> <p>--&gt; filename = os.path.join(tmpdir, name) ```</p> <p>Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88</p> <p>`os.path.join()` discards the first argument `tmpdir` if the second begins with a slash or drive letter. `name` is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of &#39;..&#39; with &#39;.&#39;, it is insufficient.</p> <p>### Risk Assessment As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like https://github.com/advisories/GHSA-r9hx-vwmv-q579, and as described by POC 4 in https://github.com/advisories/GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.</p> <p>### Impact An attacker would be allowed to write files to arbitrary locations on th…</p> https://db.gcve.eu/vuln/ghsa-5rjg-fvgr-3xxf