CVE-2021-32633: Zope Untrusted Module Access Vulnerability
Summary
CVE-2021-32633: Zope is an open-source web application server. Affects zope across 3 version ranges.
< 1f8456bf1f908ea46012537d52bd7e752a532c91
< 4.6
>= 5.0, < 5.2
Fixed in 4.6 or 5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zope is an open-source web application server that allows users to develop and deploy web applications. It provides a range of features and functionalities for building dynamic websites. Zope allows users to add and edit Zope Page Templates through the web, but this feature can be exploited by untrusted users.
Vulnerability Detail
In Zope versions prior to 4.6 and 5.2, there is a vulnerability that allows untrusted users to indirectly access untrusted modules through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web. However, if a site allows untrusted users to perform these actions, they are at risk. This vulnerability can lead to unauthorized access, code execution, and potential security breaches. The issue has been addressed in Zope 4.6 and 5.2.
How To Fix
Latest published version: 6.3.0 as of 23 Oct 2026
pip install --upgrade "zope==6.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.64.6pip install --upgrade "zope==4.6" -
>= 5.0, < 5.25.2pip install --upgrade "zope==5.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, site administrators can restrict the ability to add or edit Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role, and only trusted users should be allowed to perform these actions.
Conclusion
The Zope Untrusted Module Access Vulnerability allows untrusted users to indirectly access untrusted modules, potentially leading to unauthorized access and code execution. It is crucial to upgrade to Zope version 4.6 or 5.2 to mitigate this vulnerability. Site administrators can also implement a temporary workaround by restricting the ability to add or edit Zope Page Templates through the web. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zope →
FAQ
Zope is an open-source web application server that allows users to develop and deploy web applications. It provides a range of features and functionalities for building dynamic websites.
This vulnerability allows untrusted users to indirectly access untrusted modules through Python modules that are available for direct use. It can lead to unauthorized access, code execution, and potential security breaches.
Zope versions prior to 4.6 and 5.2 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Zope version 4.6 or 5.2, where the issue has been resolved. Users should update their Zope installation to the latest available version.
Yes, as a temporary workaround, site administrators can restrict the ability to add or edit Zope Page Templates through the web using the standard Zope user/role permission mechanisms.
Related vulnerabilities
Recent vulnerabilities recorded for zope.
