Remote Code Execution via traversal in TAL expressions
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use. By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk. The problem has been fixed in Zope 5.2.1 and 4.6.1. The workaround is the same as for https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zopefoundation | Zope | 5.0.0 to before 5.2.1; before 4.6.1 | 5.2.1, 4.6.1 | Patch available | CNA |
| — | Zope (PyPI) | 5.0 to before 5.2.1 | 5.2.1 | Patch available | GHSA-rpcg-f9q6-2mq6 |
| — | Zope (PyPI) | before 4.6.1 | 4.6.1 | Patch available | GHSA-rpcg-f9q6-2mq6 |
- Zope Vendorzopefoundation Affected 5.0.0 to before 5.2.1; before 4.6.1 Fixed in 5.2.1, 4.6.1 Patch available CNA
- Zope (PyPI) Vendor— Affected 5.0 to before 5.2.1 Fixed in 5.2.1 Patch available GHSA-rpcg-f9q6-2mq6
- Zope (PyPI) Vendor— Affected before 4.6.1 Fixed in 4.6.1 Patch available GHSA-rpcg-f9q6-2mq6
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:* | before 4.6.1; 5.0.0 to before 5.2.1 | Vulnerable | zopefoundation |
- cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:* Versions before 4.6.1; 5.0.0 to before 5.2.1 Vulnerable ·zopefoundation
Remediation
- Fix · CNA Zope (zopefoundation) Fixed in 5.2.1, 4.6.1
- Fix · GHSA-rpcg-f9q6-2mq6 Zope (PyPI) Fixed in 5.2.1 Advisory →
- Fix · GHSA-rpcg-f9q6-2mq6 Zope (PyPI) Fixed in 4.6.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32674
- 2026-10-03 Alias added: GHSA-rpcg-f9q6-2mq6
References
Advisory 4
More zopefoundation Zope vulnerabilities
- TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
- TI-2000-00062 The DTML implementation in the Z Object Publishing Environment (Zope) allows remote… CVSS 2.0HIGH 10.0
- TI-2021-12302 Remote Code Execution via traversal in TAL expressions CVSS 3.1HIGH 8.8
- TI-2005-03148 docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to… CVSS 2.0HIGH 7.5
- TI-2000-00483 The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify… CVSS 2.0HIGH 7.5
- TI-2021-12476 Remote Code Execution via Script (Python) objects under Python 3 CVSS 3.1HIGH 7.5
Sources
- CVE-2021-32674 · CVE Program
- CVE-2021-32674 · NVD
- FIRST EPSS
- GHSA-rpcg-f9q6-2mq6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences