Remote Code Execution via traversal in TAL expressions in Zope
Summary
CVE-2021-32633: Remote Code Execution via traversal in TAL expressions. Affects zope across 2 version ranges.
< 4.6.1
>= 5.0, < 5.2.1
Fixed in 4.6.1 or 5.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zope is an open-source web application server written in Python. It provides a platform for building and managing web applications. TAL (Template Attribute Language) is a templating language used in Zope to generate dynamic web content. TAL expressions allow the inclusion of Python code within templates to perform various operations. However, certain untrusted Python modules can be indirectly accessed through TAL expressions, leading to potential security vulnerabilities.
Vulnerability Detail
This vulnerability allows remote code execution via traversal in TAL expressions. While most Python modules are restricted from use in TAL expressions to prevent file system access, some untrusted modules can still be accessed indirectly through other Python modules. By default, only users with the Manager role can add or edit Zope Page Templates through the web, making only sites that allow untrusted users to perform these actions vulnerable. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code on the server.
How To Fix
Latest published version: 6.3.0 as of 23 Oct 2026
pip install --upgrade "zope==6.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.6.14.6.1pip install --upgrade "zope==4.6.1" -
>= 5.0, < 5.2.15.2.1pip install --upgrade "zope==5.2.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A workaround for this vulnerability is to restrict the ability to add or edit Zope Page Templates through the web to trusted users only. This can be achieved by adjusting the user and role permissions in Zope. Untrusted users should not be assigned the Manager role.
Conclusion
The vulnerability in Zope that allows remote code execution via traversal in TAL expressions has been addressed in the latest patched versions. It is recommended to update to these versions to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for zope →
FAQ
Zope is an open-source web application server written in Python. It provides a platform for building and managing web applications.
TAL (Template Attribute Language) is a templating language used in Zope to generate dynamic web content. It allows the inclusion of Python code within templates.
The vulnerability allows remote code execution via traversal in TAL expressions. An attacker can execute arbitrary code on the server if they have the ability to add or edit Zope Page Templates through the web.
To fix the vulnerability, update to the latest patched version of Zope (5.21 or 4.6.1).
Yes, you can restrict the ability to add or edit Zope Page Templates through the web to trusted users only by adjusting user and role permissions.
References
Related vulnerabilities
Recent vulnerabilities recorded for zope.
