VDB
KO
LOW

GHSA-jcjp-qqpq-pc54

Zope allows local users to read arbitrary files

Details

Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / zope2
Introduced in: 2.7.0 Fixed in: 2.7.8
Fix pip install --upgrade 'zope2>=2.7.8'
PyPI / zope2
Introduced in: 2.8.0 Fixed in: 2.8.7
Fix pip install --upgrade 'zope2>=2.8.7'
PyPI / zope2
Introduced in: 2.9.0 Fixed in: 2.9.3
Fix pip install --upgrade 'zope2>=2.9.3'

References