Threats tagged 'brew-pyqt-builder-cve-2025-47273'

A path traversal vulnerability in setuptools' PackageIndex.download method allows an attacker to write files to arbitrary filesystem locations. This occurs because the filename derived from a URL is insufficiently sanitized, enabling traversal outside the intended temporary directory. The issue was fixed in setuptools version 1.18.1_1. Exploitation could lead to arbitrary file write with the permissions of the running process, potentially escalating to remote code execution depending on context.