CVE-2008-0252: Directory Traversal Vulnerability in CherryPy
Summary
CVE-2008-0252: Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows r... Affects cherrypy across 2 version ranges.
< 2.1.1
>= 3.0, < 3.0.2
Fixed in 2.1.1 or 3.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- cherrypy3 · Debian:11
The same CVE-2008-0252 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CherryPy is a Python web framework that allows developers to build web applications. It provides a simple and efficient way to handle HTTP requests and responses. The framework is widely used and has a large user community. However, versions 2.x and 3.0.x up to 3.0.2 of CherryPy are vulnerable to a directory traversal vulnerability.
Vulnerability Detail
The vulnerability exists in the _get_file_path function in the sessions module of CherryPy. It allows remote attackers to manipulate session IDs in cookies to create or delete arbitrary files. Additionally, it may enable them to read and write portions of arbitrary files on the server. This can lead to unauthorized access, data leakage, and potential compromise of the web application and server.
How To Fix
Latest published version: 18.10.0 as of 23 Oct 2026
pip install --upgrade "cherrypy==18.10.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.1.12.1.1pip install --upgrade "cherrypy==2.1.1" -
>= 3.0, < 3.0.23.0.2pip install --upgrade "cherrypy==3.0.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a temporary workaround is to disable the use of session cookies in the CherryPy configuration. This can be achieved by modifying the configuration file or code to remove or comment out the session-related settings. However, this workaround may impact the functionality of applications relying on session management.
Conclusion
The directory traversal vulnerability in CherryPy can be mitigated by upgrading to a fixed version or applying a temporary workaround. It is crucial to take prompt action to protect the web application and server from potential unauthorized access and data leakage. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cherrypy →
FAQ
CherryPy is a Python web framework that simplifies the development of web applications by providing an efficient way to handle HTTP requests and responses.
Versions 2.x and 3.0.x up to 3.0.2 of CherryPy are affected by this directory traversal vulnerability.
The vulnerability allows remote attackers to create or delete arbitrary files and potentially read and write portions of arbitrary files on the server. This can lead to unauthorized access, data leakage, and compromise of the web application and server.
To fix this vulnerability, it is recommended to upgrade to a fixed version of CherryPy, specifically version 2.1.1 or version 3.0.2.
Yes, a temporary workaround is to disable the use of session cookies in the CherryPy configuration. However, this may impact the functionality of applications relying on session management.
Related vulnerabilities
Recent vulnerabilities recorded for cherrypy.
