{"action":"Upgrade cherrypy to 2.1.1 or later.","affected":[{"fixed":"2.1.1","introduced":"0"},{"fixed":"3.0.2","introduced":"3.0"}],"component":"cherrypy","cve_ids":["CVE-2008-0252"],"ecosystem":"PyPI","epss":0.02669,"exploited":false,"fixed_versions":["2.1.1","3.0.2"],"ghsa_id":"GHSA-76x8-gg39-5jjg","id":"tcs_01M5KG54NNTSREPQ63WZE5W1YF","modified_at":"2026-06-10T17:00:43.536286545Z","published_at":"2008-01-12T02:46:00Z","references":["https://osv.dev/vulnerability/PYSEC-2008-3","http://www.cherrypy.org/changeset/1774","http://www.cherrypy.org/changeset/1775","http://www.cherrypy.org/changeset/1776","http://www.cherrypy.org/ticket/744","https://bugs.gentoo.org/show_bug.cgi?id=204829","http://secunia.com/advisories/28354","https://issues.rpath.com/browse/RPL-2127","http://www.securityfocus.com/bid/27181","http://secunia.com/advisories/28611","http://security.gentoo.org/glsa/glsa-200801-11.xml","http://secunia.com/advisories/28620","http://www.debian.org/security/2008/dsa-1481","http://secunia.com/advisories/28769","http://secunia.com/advisories/28353","https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00297.html","https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00240.html","http://www.vupen.com/english/advisories/2008/0039","http://www.securityfocus.com/archive/1/487001/100/0/threaded","https://github.com/advisories/GHSA-76x8-gg39-5jjg"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2008-3","url":"https://osv.dev/vulnerability/PYSEC-2008-3"}],"summary":"Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in C"}