Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Affected versions of setuptools ≤ 69.1.1 are vulnerable to path traversal and command injection in the package_index module’s download functions (CVE-2024-6345), allowing arbitrary file writes and remote code execution via crafted URLs. Vulnerable function: _resolve_download_filename fails to enforce tmpdir boundaries.

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Affected versions of setuptools ≤ 69.1.1 are vulnerable to path traversal and command injection in the package_index module’s download functions (CVE-2024-6345), allowing arbitrary file writes and remote code execution via crafted URLs. Vulnerable function: _resolve_download_filename fails to enforce tmpdir boundaries.

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Affected versions of setuptools ≤ 69.1.1 are vulnerable to path traversal and command injection in the package_index module’s download functions (CVE-2024-6345), allowing arbitrary file writes and remote code execution via crafted URLs. Vulnerable function: _resolve_download_filename fails to enforce tmpdir boundaries.

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Affected versions of setuptools ≤ 69.1.1 are vulnerable to path traversal and command injection in the package_index module’s download functions (CVE-2024-6345), allowing arbitrary file writes and remote code execution via crafted URLs. Vulnerable function: _resolve_download_filename fails to enforce tmpdir boundaries.

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Affected versions of setuptools ≤ 69.1.1 are vulnerable to path traversal and command injection in the package_index module’s download functions (CVE-2024-6345), allowing arbitrary file writes and remote code execution via crafted URLs. Vulnerable function: _resolve_download_filename fails to enforce tmpdir boundaries.

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Affected versions of setuptools ≤ 69.1.1 are vulnerable to path traversal and command injection in the package_index module’s download functions (CVE-2024-6345), allowing arbitrary file writes and remote code execution via crafted URLs. Vulnerable function: _resolve_download_filename fails to enforce tmpdir boundaries.

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Affected versions of setuptools ≤ 69.1.1 are vulnerable to path traversal and command injection in the package_index module’s download functions (CVE-2024-6345), allowing arbitrary file writes and remote code execution via crafted URLs. Vulnerable function: _resolve_download_filename fails to enforce tmpdir boundaries.