PyPI/zope CVE-2021-32633: medium 6.8, EPSS 1.86%

Remote Code Execution via traversal in TAL expressions

Action: Upgrade zope to 4.6 or later.

pip install zope==4.6

pip install zope==5.2

Affected

Fixed versions

Sources

• osv: GHSA-5pr9-v234-jw36
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36
• https://nvd.nist.gov/vuln/detail/CVE-2021-32633
• https://github.com/zopefoundation/Zope/commit/1f8456bf1f908ea46012537d52bd7e752a532c91
• https://cyllective.com/blog/post/plone-authenticated-rce-cve-2021-32633
• https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2021-88.yaml
• https://github.com/zopefoundation/Zope
• http://www.openwall.com/lists/oss-security/2021/05/21/1
• http://www.openwall.com/lists/oss-security/2021/05/22/1

CVE-2021-32633 · published 2021-06-18T18:44:01Z · modified 2026-07-09T16:56:33.295188851Z · JSON