← Vulnerability feed

Vulnerability record · CVE-2021-32674 · published 8 June 2021

CVE-2021-32674: Zope path traversal vulnerability

Zope · Zope

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use. By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk. The problem has been fixed in Zope 5.2.1 and 4.6.1. The workaround is the same as for https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

8.8 CVSS 3.1 High EPSS 1.6% · top 25.4% CWE-22 · Path traversal
8.8CVSS 3.1 base score, v2 6.5
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use. By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk. The problem has been fixed in Zope 5.2.1 and 4.6.1. The workaround is the same as for https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/zopefoundation/Zope/commit/1d897910139e2c0b11984fc9b78c1da1365bec21 PatchThird Party Advisory
https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 Third Party Advisory
https://github.com/zopefoundation/Zope/security/advisories/GHSA-rpcg-f9q6-2mq6 Third Party Advisory
https://pypi.org/project/Zope/ Product
https://github.com/zopefoundation/Zope/commit/1d897910139e2c0b11984fc9b78c1da1365bec21 PatchThird Party Advisory
https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 Third Party Advisory
https://github.com/zopefoundation/Zope/security/advisories/GHSA-rpcg-f9q6-2mq6 Third Party Advisory
https://pypi.org/project/Zope/ Product

Track CVE-2021-32674 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2000-0062Zope vulnerabilityThe DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.EPSS 2.2%9.3CVE-2011-3587Zope p_ class remote command execution in PloneZope 2.12.x and 2.13.x, as shipped in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, contains an unspecified flaw tied to the p_ class in OFS…EPSS 78%analysed8.8CVE-2021-32633Plone path traversal vulnerabilityZope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python mo…EPSS 1.9%7.7CVE-2023-41050Zope accesscontrol information exposure vulnerabilityAccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to …EPSS 0.64%7.5CVE-2011-2528Plone hotfix 20110720 vulnerabilityUnspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix201…EPSS 2.0%7.5CVE-2005-3323Zope vulnerabilitydocutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in Restructure…EPSS 3.0%7.5CVE-2002-0688Zope vulnerabilityZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and ca…EPSS 1.4%7.5CVE-2002-0170Zope vulnerabilityZope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violat…EPSS 1.6%

Source: NIST National Vulnerability Database (record CVE-2021-32674), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.