Threats tagged 'brew-python@3.11-cve-2025-47273'

A path traversal vulnerability in setuptools' PackageIndex.download function allows an attacker to write files to arbitrary filesystem locations. This flaw arises from insufficient sanitization of URL-derived filenames, enabling os.path.join to be bypassed. The vulnerability affects Python 3.11 versions from 3.11.0 up to but not including 3.11.12_1. A fix is available in version 3.11.12_1. Exploitation could lead to arbitrary file write with the permissions of the running process, potentially escalating to remote code execution depending on context.