Merge pull request #5150 from UladzimirTrehubenka/backport_cve_47273

Backport CVE-47273 fix from 78.1.1 to 75.3.x.

Author: jaraco

newsfragments/4946.bugfix.rst

@@ -0,0 +1 @@
+Backport CVE-47273 from 78.1.1 for Python 3.8.

setuptools/package_index.py

@@ -868,7 +868,13 @@ def _resolve_download_filename(cls, url, tmpdir):
         # strip any extra .zip before download
         name = re.sub(r'\.egg\.zip$', '.egg', name)
 
-        return os.path.join(tmpdir, name)
+        filename = os.path.join(tmpdir, name)
+
+        # ensure path resolves within the tmpdir - fix CVE-2025-47273
+        if not filename.startswith(str(tmpdir)):
+            raise ValueError(f"Invalid filename {filename}")
+
+        return filename
 
     def _download_url(self, url, tmpdir):
         """