CVE-2006-0847: Directory Traversal Vulnerability in CherryPy
Summary
CVE-2006-0847: Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors. Affects cherrypy versions < 2.1.1. Fixed in 2.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CherryPy is a Python web framework that allows developers to build web applications. It provides a simple and intuitive interface for handling HTTP requests and responses. The framework is widely used and offers various features such as session management, URL routing, and static file serving. However, prior to version 2.1.1, CherryPy was susceptible to a directory traversal vulnerability.
Vulnerability Detail
The directory traversal vulnerability in CherryPy allows remote attackers to read arbitrary files by exploiting ".." sequences in unspecified vectors. This means that an attacker can traverse directories and access sensitive files on the server. The impact of this vulnerability can be severe, as it may lead to unauthorized disclosure of sensitive information or even compromise the entire system. It is crucial to address this vulnerability promptly to prevent potential attacks.
How To Fix
Latest published version: 18.10.0 as of 23 Oct 2026
pip install --upgrade "cherrypy==18.10.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.1
This is the first release that contains the fix.
pip install --upgrade "cherrypy==2.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The directory traversal vulnerability in CherryPy can have serious implications for the security of web applications. It is crucial to upgrade to the latest version of CherryPy (2.1.1 or later) to mitigate this vulnerability. Failure to address this issue may result in unauthorized access to sensitive files and potential system compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cherrypy →
FAQ
CherryPy is a Python web framework used for developing web applications. It provides a convenient and efficient way to handle HTTP requests and responses.
A directory traversal vulnerability allows an attacker to access files outside of the intended directory. By manipulating file paths or using special characters like "..", an attacker can traverse directories and potentially access sensitive files.
This vulnerability can be exploited by sending specially crafted requests to the affected server. By including ".." sequences in the request, an attacker can navigate to directories outside of the intended scope and read arbitrary files.
The consequences of this vulnerability can be severe. An attacker may gain unauthorized access to sensitive information, such as configuration files or user data. In some cases, this vulnerability can lead to a complete compromise of the system.
Yes, the vulnerability can be fixed by upgrading CherryPy to version 2.1.1 or later. The fix implemented in this version addresses the directory traversal vulnerability and prevents unauthorized file access.
Related vulnerabilities
Recent vulnerabilities recorded for cherrypy.
