MEDIUM6.1

PYSEC-2026-1060

Open redirect in web2py

Quick fix

PYSEC-2026-1060 — web2py: upgrade to the fixed version with the command below.

pip install --upgrade 'web2py>=2.22.5'

Details

Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/web2py

Introduced in: 0Fixed in: 2.22.5

Fixpip install --upgrade 'web2py>=2.22.5'

References

https://nvd.nist.gov/vuln/detail/CVE-2022-33146[ADVISORY]
https://github.com/web2py/web2py/commit/a181b855a43cb8b479d276b082cfcde385768451[WEB]
https://github.com/web2py/web2py/commit/d9805606f88f00c0be56438247605cefde73e14e#diff-c1d01f37ee54d813815718760b9c4d7b274e2be7ad18f65552cd564336ab593bR110[WEB]
https://github.com/web2py/web2py[PACKAGE]
https://jvn.jp/en/jp/JVN02158640/index.html[WEB]
http://web2py.com[WEB]
https://pypi.org/project/web2py[PACKAGE]
https://github.com/advisories/GHSA-cgrj-xjm7-9q27[ADVISORY]