EUVD-2026-84150
GHSA-whpq-2rxm-79rp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to web2py admin interface
-
DeliveryCall read_file()/write_file() webservice with ../ path
-
ExploitEscape admin application directory
-
ExecutionRead or overwrite arbitrary server files
-
ImpactEscalate to code execution or exfiltrate secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to the web2py administrative interface, because the vulnerable read_file()/write_file() endpoints reside in applications/admin/controllers/webservices.py, which is protected by the admin password (PR:H). Given that access, no user interaction is needed (UI:N) and the request is delivered over the network (AV:N) with low complexity. Limiting factors: the admin app must be enabled and reachable (it is often restricted to localhost/HTTPS or disabled in hardened deployments), and the attacker must already hold admin credentials. Affected build is web2py 3.2.2-stable at commit a7330a2bf21219fa77860b6665de927dd4f98e6d. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, base 6.5) describes a network-reachable, low-complexity flaw that nonetheless requires high privileges (PR:H) - consistent with the affected code living in web2py's admin application (applications/admin/controllers/webservices.py), which is gated behind the administrative interface password. This is a meaningful downgrade from a raw 'critical' read because an attacker must first be authenticated to the admin console. EPSS is low (0.22%, 13th percentile) and there is no CISA KEV listing, so there is no evidence of widespread automated exploitation; risk is opportunistic/targeted rather than mass-scanned. One reference points to a third-party researcher CVE writeup (github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79318.md), which typically contains reproduction detail, but the input does not carry an explicit POC=YES flag, so exploit-code availability should be treated as unconfirmed. Net: this is a moderate, precondition-heavy issue - genuinely dangerous once admin access is held (arbitrary file read AND write via read_file/write_file can escalate to code execution), but the PR:H gate and absence of KEV/EPSS signal keep it out of emergency-patch territory for most defenders. |
| Exploit ScenarioDerived | An attacker who has obtained (or brute-forced/reused) the web2py admin interface password sends a crafted filename containing '../' sequences to the read_file() or write_file() web service in applications/admin/controllers/webservices.py, escaping the intended application directory. This lets them read sensitive host files (config, credentials, private keys) and, via write_file(), plant or overwrite files anywhere the web2py process can write - potentially dropping a controller or WSGI file for code execution. A public technical writeup referenced for this CVE likely documents the exact traversal payload. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Authenticated administrative users of web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) can abuse the read_file() and write_file() endpoints in the admin application's webservices controller to traverse outside the intended web2py directory and read or overwrite arbitrary files on the host. Because those endpoints sit behind the admin interface password, exploitation requires high privileges (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, base 6.5) and depends on the admin app being enabled and network-reachable, which hardened deployments often prevent by binding it to localhost, disabling it, or fronting it with additional authentication. No public exploit code has been identified at time of analysis and the flaw is not on CISA KEV; EPSS is low at 0.22% (13th percentile), so exploitation is currently assessed as opportunistic rather than widespread.
RemediationAI
No vendor-released patch version is identified in the provided intelligence, so the primary action is to track the upstream repository at https://github.com/web2py/web2py for a fix commit or new stable release and upgrade web2py as soon as a corrected build is published, since the confirmed vulnerable build is 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d). Until then, apply compensating controls that directly remove the exposed surface: if the admin application is not needed in production, remove or disable applications/admin entirely (for example by deleting the admin app from the deployment rather than just hiding the route), accepting the trade-off that all administrative UI functionality is lost, or at minimum bind the admin interface to localhost/loopback or a management VLAN and restrict it with firewall rules or an authenticating reverse proxy, accepting the trade-off that remote administration then requires a jump host or VPN. Reduce the blast radius by running web2py under a dedicated low-privilege account whose filesystem write access is confined to the deployment directory, and by keeping config files, database credentials and SSH keys outside any path that account can modify; note this limits but does not eliminate the read/write primitive. Because the flaw requires high privileges (PR:H), also treat any compromise or sharing of admin credentials as the enabling precondition: enforce unique, strong admin passwords, avoid shared admin accounts, and monitor the admin app for anomalous file-oriented requests, accepting the trade-off that credential rotation alone will not stop an attacker who already holds valid admin credentials and detects no exploit by itself.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is the file-serving and file-writing logic used by web2py's bundled administrative application, specifically read_file() and write_file() in applications/admin/controllers/webservices.py. The root cause class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): attacker-controlled path components are joined into a filesystem path without normalizing the result or verifying that the resolved path remains inside the intended base directory, so '../' sequences (and equivalent encodings) escape the web2py tree. web2py is a Python web framework whose admin application is delivered as an ordinary web2py app, which is why the exposed surface is a web endpoint rather than a local API and why reachability depends on whether the admin app is deployed and exposed. The supplied CPE string is an unresolved placeholder (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) and EUVD likewise lists 'n/a n/a', so product identification rests on the description and the upstream repository rather than on CPE matching; the only build confirmed as affected in the input data is 3.2.2-stable at commit a7330a2bf21219fa77860b6665de927dd4f98e6d. Confidentiality and integrity are both rated High while availability is rated None, consistent with a traversal primitive aimed at reading secrets/config or planting content rather than a denial-of-service.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Endpoint is in the password-protected admin app so PR:H; network-reachable and low-complexity; read_file plus write_file gives high confidentiality and integrity impact, no direct availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB