Path traversal in setuptools - #VU162973
Published: November 9, 2026
Vulnerability identifier: #VU162973
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated attacker to create a fixed-content __init__.py outside the intended installation directory with the installing process's permissions.
The vulnerability exists due to unchecked absolute Windows paths in wheel namespace_packages.txt metadata during setuptools' legacy wheel installation. An unauthenticated attacker can supply a crafted wheel for a victim to install through this mechanism, creating the file in an existing directory writable by the installer where the file does not already exist.
Affected software
setuptools
Remediation
Install security update from vendor's website.
setuptools - update to 84.1.0