CVE-2009-2701: ZODB 3.8 and 3.9 Remote File Read/Delete Vulnerability
Summary
CVE-2009-2701: Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are... Affects zodb3 across 2 version ranges.
>= 3.8, < 3.8.3
>= 3.9a0, < 3.9.0c2
Fixed in 3.8.3 or 3.9.0c2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ZODB (Zope Object Database) is a native object database for Python. It provides a way to store Python objects directly in a database without requiring a separate mapping layer. ZODB is commonly used in conjunction with ZEO (Zope Enterprise Objects) to enable distributed storage and sharing of objects across multiple Zope applications. ZEO allows multiple ZODB clients to connect to a shared storage server, providing scalability and fault tolerance. However, when certain ZEO database sharing and blob support are enabled, a vulnerability in ZODB versions 3.8 before 3.8.3 and 3.9.x before 3.9.0c2 allows remote authenticated users to read or delete arbitrary files.
Vulnerability Detail
The vulnerability in ZODB arises when ZEO database sharing and blob support are enabled. It allows remote authenticated users to read or delete arbitrary files through unknown vectors. The specific details of these vectors are not disclosed in the vulnerability report. This vulnerability can be exploited by attackers who have authenticated access to the ZEO storage-server functionality. The impact of this vulnerability can be significant as it allows unauthorized access to sensitive files and the potential for data loss or manipulation.
How To Fix
Latest published version: 3.11.0 as of 22 Oct 2026
pip install --upgrade "zodb3==3.11.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.8, < 3.8.33.8.3pip install --upgrade "zodb3==3.8.3" -
>= 3.9a0, < 3.9.0c23.9.0c2pip install --upgrade "zodb3==3.9.0c2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround is mentioned in the vulnerability report. However, as a general best practice, it is recommended to ensure that only trusted and authenticated users have access to the ZEO storage-server functionality. Additionally, implementing proper access controls and permissions for the ZEO server can help mitigate the risk of unauthorized access and exploitation of this vulnerability.
Conclusion
In conclusion, the ZODB vulnerability (CVE-2009-2701) in versions 3.8 before 3.8.3 and 3.9.x before 3.9.0c2 allows remote authenticated users to read or delete arbitrary files. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of ZODB (3.8.3 or 3.9.0c2) and follow the recommended upgrade process. Implementing proper access controls and permissions for the ZEO server is also advised. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zodb3 →
FAQ
ZODB (Zope Object Database) is a native object database for Python. It allows storing Python objects directly in a database without requiring a separate mapping layer.
ZEO (Zope Enterprise Objects) is a component of ZODB that enables distributed storage and sharing of objects across multiple Zope applications. It allows multiple ZODB clients to connect to a shared storage server.
The vulnerability affects ZODB versions 3.8 before 3.8.3 and 3.9.x before 3.9.0c2.
An attacker with authenticated access to the ZEO storage-server functionality can exploit this vulnerability to read or delete arbitrary files. The specific vectors used for exploitation are not disclosed in the vulnerability report.
The vulnerability allows unauthorized access to sensitive files and the potential for data loss or manipulation.
Related vulnerabilities
Recent vulnerabilities recorded for zodb3.
