SB20261109164 - Path traversal in setuptools

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109164

SB20261109164 - Path traversal in setuptools

Published: November 9, 2026

Security Bulletin ID SB20261109164
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to create a fixed-content __init__.py outside the intended installation directory with the installing process's permissions.

The vulnerability exists due to unchecked absolute Windows paths in wheel namespace_packages.txt metadata during setuptools' legacy wheel installation. An unauthenticated attacker can supply a crafted wheel for a victim to install through this mechanism, creating the file in an existing directory writable by the installer where the file does not already exist.


Remediation

Install update from vendor's website.

References