TI-2021-12302 Aliases CVE-2021-32633 GHSA-5pr9-v234-jw36

Remote Code Execution via traversal in TAL expressions

MEDIUM 42CWE-22Published 2021-05-21 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

Why it matters now

EPSS 0.01858 79th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Zope (zopefoundation): 4.6, 5.2Zope (PyPI): 4.6, 5.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zopefoundation	Zope	before 4.6; 5.0 to before 5.2	4.6, 5.2	Patch available	CNA
—	Zope (PyPI)	before 4.6	4.6	Patch available	GHSA-5pr9-v234-jw36
—	Zope (PyPI)	5.0 to before 5.2	5.2	Patch available	GHSA-5pr9-v234-jw36

Zope Vendorzopefoundation Affected before 4.6; 5.0 to before 5.2 Fixed in 4.6, 5.2 Patch available CNA
Zope (PyPI) Vendor— Affected before 4.6 Fixed in 4.6 Patch available GHSA-5pr9-v234-jw36
Zope (PyPI) Vendor— Affected 5.0 to before 5.2 Fixed in 5.2 Patch available GHSA-5pr9-v234-jw36

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:plone:plone::::::::	up to 4.3.20; 5.0 – 5.2.4	Vulnerable	plone
cpe:2.3:a:zope:zope::::::::	before 4.6; 5.0 to before 5.2	Vulnerable	zopefoundation

cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:* Versions up to 4.3.20; 5.0 – 5.2.4 Vulnerable ·plone
cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:* Versions before 4.6; 5.0 to before 5.2 Vulnerable ·zopefoundation

Remediation

Fix · CNA Zope (zopefoundation) Fixed in 4.6, 5.2
Fix · GHSA-5pr9-v234-jw36 Zope (PyPI) Fixed in 4.6 Advisory →
Fix · GHSA-5pr9-v234-jw36 Zope (PyPI) Fixed in 5.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-32633
2026-10-03 Alias added: GHSA-5pr9-v234-jw36

References

Exploit 1

https://cyllective.com/blog/post/plone-authenticated-rce-cve-2021-32633/

Patch 1

https://github.com/zopefoundation/Zope/commit/1f8456bf1f908ea46012537d52bd7e752a532c91

Advisory 4

Other 3

TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
TI-2000-00062 The DTML implementation in the Z Object Publishing Environment (Zope) allows remote… CVSS 2.0HIGH 10.0
TI-2021-12342 Remote Code Execution via traversal in TAL expressions CVSS 3.1HIGH 8.8
TI-2005-03148 docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to… CVSS 2.0HIGH 7.5
TI-2000-00483 The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify… CVSS 2.0HIGH 7.5
TI-2021-12476 Remote Code Execution via Script (Python) objects under Python 3 CVSS 3.1HIGH 7.5

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences