CVE-2021-32633: Path Traversal in Zope
Summary
CVE-2021-32633: Duplicate Advisory: Path Traversal in Zope. Affects zope across 2 version ranges.
< 4.6
>= 5.0, < 5.2
Fixed in 4.6 or 5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zope is an open-source web application server that allows users to develop and deploy web applications. It provides a range of features and functionalities for building dynamic websites. However, versions prior to 4.6 and 5.2 of Zope are vulnerable to a path traversal vulnerability.
Vulnerability Detail
The path traversal vulnerability in Zope allows untrusted users to indirectly access modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web. However, if a site allows untrusted users to perform these actions, they are at risk. This vulnerability can be exploited to gain unauthorized access and potentially execute arbitrary code on the server. The issue has been addressed in Zope versions 4.6 and 5.2.
How To Fix
Latest published version: 6.3.0 as of 23 Oct 2026
pip install --upgrade "zope==6.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.64.6pip install --upgrade "zope==4.6" -
>= 5.0, < 5.25.2pip install --upgrade "zope==5.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, site administrators can restrict the ability to add or edit Zope Page Templates through the web by adjusting the user/role permissions. Untrusted users should not be assigned the Zope Manager role, and only trusted users should be allowed to perform these actions.
Conclusion
In conclusion, the path traversal vulnerability in Zope can be mitigated by updating to the fixed versions and implementing proper user/role permissions. It is important to promptly address this vulnerability to prevent unauthorized access and potential code execution on the server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zope →
FAQ
Zope is an open-source web application server used for developing and deploying web applications.
Versions prior to 4.6 and 5.2 of Zope are affected by this vulnerability.
This vulnerability allows untrusted users to gain unauthorized access and potentially execute arbitrary code on the server.
To fix this vulnerability, update Zope to version 4.6 or 5.2 and restrict the ability to add or edit Zope Page Templates through the web.
Yes, site administrators can restrict the ability to add or edit Zope Page Templates through the web by adjusting user/role permissions.
References
Related vulnerabilities
Recent vulnerabilities recorded for zope.
