CVE-2026-79318
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py).
Risk Assessment
Attackers can access files outside the allowed directory, potentially leading to disclosure of sensitive data or file modification.
Recommendation
Update web2py to a patched version. Restrict access to administrative functions and validate file paths.
Other vulnerabilities in web2py
See all- CVE-2016-4808High
Web2py versions 2.14.5 and below are affected by a CSRF (Cross Site Request Forgery) vulnerability, allowing an attacker to trick a logged-in user into performing unwanted actions. An attacker can deceive a victim into disabling the installed application simply by sending a URL.
- CVE-2016-4806High
Web2py versions 2.14.5 and below is affected by a Local File Inclusion vulnerability, allowing a malicious user to access sensitive web server files.
- CVE-2016-10321Critical
Web2py versions before 2.14.6 do not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
Original NVD description (English source)
web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS