Skip to content
Verified reproduction

CVE-2025-47273: Setuptools Path Traversal via PackageIndex.download

Download script Open in Codespaces

CVE-2025-47273 is verified against setuptools · pip affected versions: setuptools < 78.1.1 fixed version: 78.1.1 vulnerability class: Path Traversal This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00001.

REPRO-2026-00001 setuptools · pip Path Traversal Jan 7, 2026 CVE entry .txt
Severity HIGH
Confidence HIGH
Reproduced in 14m 9s
Tool calls 34
Affected setuptools < 78.1.1
Fixed in 78.1.1
01 · Reproduce
Download script Open in Codespaces →
$ pruva-verify REPRO-2026-00001
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00001/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · Root cause 
Insufficient sanitization of filename derived from URL allows absolute-path write; os.path.join(tmpdir, name) is bypassed when name starts with '/', \ or a drive letter.
03 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.

Loading session...
04 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available