CVE-2021-32811: Remote Code Execution in Zope
Summary
CVE-2021-32807: Zope is an open-source web application server. Affects accesscontrol across 2 version ranges.
>= 4.0, < 4.3
>= 5.0, < 5.2
Fixed in 4.3 or 5.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-32807 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zope is an open-source web application server that allows users to build and deploy web applications. It supports Python 3 and provides various features for managing web content. One of the optional add-on packages for Zope is Products.PythonScripts, which allows users to add and edit Python scripts through the web interface. By default, only users with the admin-level Zope 'Manager' role can perform these actions. However, if untrusted users are granted access to add or edit these scripts, a remote code execution vulnerability can be exploited.
Vulnerability Detail
The vulnerability (CVE-2021-32811) exists in Zope versions prior to 4.6.3 and 5.3 when using Python 3 and having the Products.PythonScripts add-on package installed. It allows an attacker to execute arbitrary code on the server by manipulating the Python scripts. This can lead to unauthorized access, data breaches, and potential system compromise. The vulnerability can only be exploited if untrusted users are allowed to add or edit Python scripts through the web interface.
How To Fix
Latest published version: 7.5.0 as of 23 Oct 2026
pip install --upgrade "accesscontrol==7.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.34.3pip install --upgrade "accesscontrol==4.3" -
>= 5.0, < 5.25.2pip install --upgrade "accesscontrol==5.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, site administrators can remove the Products.PythonScripts add-on package if it is not required for their application. This can eliminate the risk of the vulnerability being exploited. However, it is still recommended to upgrade to the patched versions of Zope to ensure comprehensive security.
Conclusion
Zope versions prior to 4.6.3 and 5.3 with the Products.PythonScripts add-on package installed are vulnerable to remote code execution. It is crucial to upgrade to the patched versions and restrict the ability to add or edit Python scripts through the web interface to trusted users. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for accesscontrol →
FAQ
Zope versions prior to 4.6.3 and 5.3 are affected.
Yes, the vulnerability only affects Zope deployments using Python 3.
The vulnerability allows remote code execution, which can lead to unauthorized access, data breaches, and potential system compromise.
No, the vulnerability requires untrusted users to have the ability to add or edit Python scripts through the web interface.
There are no known public exploits for this vulnerability at the time of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for accesscontrol.
