CVE-2021-32674: Path Traversal in Zope
Summary
CVE-2021-32633: Duplicate Advisory: Path Traversal in Zope. Affects zope across 2 version ranges.
< 4.6.1
>= 5.0, < 5.2.1
Fixed in 4.6.1 or 5.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Zope is an open-source web application server that allows users to add and edit Zope Page Templates through the web. However, this functionality can pose a security risk if untrusted users are granted access. By default, most Python modules are restricted to prevent file system access. However, some untrusted modules can still be indirectly accessed through Python modules available for direct use. This vulnerability allows for path traversal attacks, potentially leading to unauthorized file system access.
Vulnerability Detail
The vulnerability arises from TAL expression traversal vulnerabilities in Zope. Untrusted users with the ability to add or edit Zope Page Templates through the web can exploit this vulnerability. By manipulating TAL expressions, they can traverse the file system and access files that should be restricted. This can lead to unauthorized disclosure of sensitive information or even remote code execution. The vulnerability has been assigned a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 6.3.0 as of 23 Oct 2026
pip install --upgrade "zope==6.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.6.14.6.1pip install --upgrade "zope==4.6.1" -
>= 5.0, < 5.2.15.2.1pip install --upgrade "zope==5.2.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A temporary workaround for this vulnerability is to restrict the ability to add or edit Zope Page Templates through the web. This can be achieved by using the standard Zope user/role permission mechanisms. Site administrators should ensure that untrusted users are not assigned the Zope Manager role and that only trusted users have the ability to add or edit Zope Page Templates through the web.
Conclusion
The path traversal vulnerability in Zope can lead to unauthorized file system access and potential security breaches. It is crucial for users to update to the latest versions of Zope and implement the recommended workaround to protect their systems. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zope →
FAQ
Zope is an open-source web application server that provides a platform for building and managing web applications.
TAL (Template Attribute Language) is a templating language used in Zope to define dynamic content in web pages.
This vulnerability can be exploited by untrusted users who have the ability to add or edit Zope Page Templates through the web. By manipulating TAL expressions, they can traverse the file system and access restricted files.
The potential consequences of this vulnerability include unauthorized disclosure of sensitive information and remote code execution.
No, only versions prior to 4.6.1 and 5.2.1 are affected. It is recommended to update to these versions or later to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for zope.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
