CVE-2021-32633 json
Remote Code Execution via traversal in TAL expressions
published 2021-05-21 5 y ago modified 2026-07-09 4 mo ago also GHSA-5pr9-v234-jw36 , GHSA-962m-m8jw-8wrr , PYSEC-2021-88 , EUVD-2021-0471
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known
Summary
Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.
Patch / fix
Exploit prediction
1.86% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- cyllective.com https://cyllective.com/blog/post/plone-authenticated-rce-cve-2021-32633/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | zope | <4.6 >=5.0, <5.2 |
4.6 5.2 |
Affected products
- zopefoundation Zope
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/zopefoundation/Zope/commit/1f8456bf1f908ea46012537d52bd7e752a532c91
web, patch, third-party-advisory
-
cyllective.com
/blog/post/plone-authenticated-rce-cve-2021-32633/
exploit, third-party-advisory
-
github.com
/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36
web, third-party-advisory, advisory
-
openwall.com
/lists/oss-security/2021/05/21/1
mailing-list, web, third-party-advisory
-
openwall.com
/lists/oss-security/2021/05/22/1
mailing-list, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-32633
advisory
-
cyllective.com
/blog/post/plone-authenticated-rce-cve-2021-32633
web
-
github.com
/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2021-88.yaml
web
-
github.com
/zopefoundation/Zope
package
-
github.com
/advisories/GHSA-962m-m8jw-8wrr
advisory
Sources
- CVE List CVE-2021-32633
- GitHub Advisory GHSA-5pr9-v234-jw36
- GitHub Advisory GHSA-962m-m8jw-8wrr
- NVD CVE-2021-32633
- OSV PYSEC-2021-88
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.