Red Hat Security Advisory: python-setuptools security update
Affects Red Hat python-setuptoolsSource GCVE Database
Not known to be exploited.
Data as of 31 Oct 2026, 20:20 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 1.5% chance of exploitation in 30 days – higher than 75% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 15 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: evidence found.
Public exploit code: GitHub proofs of concept
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, the Metasploit, Exploit-DB and nuclei-templates index as of 31 Oct 2026.
What to do
AI-suggested
Red Hat has released updated python-setuptools packages that address this path traversal vulnerability. Users of Red Hat Enterprise Linux 8 and its extended life cycle versions should apply the security update as detailed in Red Hat advisory RHSA-2025:11036. Instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.
Description
A path traversal vulnerability (CVE-2025-47273) was identified in the setuptools PackageIndex component of the python-setuptools package in Red Hat Enterprise Linux 8. This vulnerability allows for potential unauthorized file system access via crafted input. Red Hat has released security updates addressing this issue with a moderate severity rating. The update is available for multiple architectures and extended life cycle versions of Red Hat Enterprise Linux 8.