{"action":"Upgrade products-cmfplone to 4.3.3 or later.","affected":[{"fixed":"4.3.3","introduced":"3.3"}],"component":"products-cmfplone","cve_ids":["CVE-2013-7060"],"ecosystem":"PyPI","epss":0.02138,"exploited":false,"fixed_versions":["4.3.3"],"ghsa_id":"GHSA-rg52-j87w-pf83","id":"tcs_01M5KG6B8VGP2ZZW4BW0JNSK7Y","modified_at":"2026-06-10T17:01:38.536782588Z","published_at":"2014-05-02T14:55:00Z","references":["https://osv.dev/vulnerability/PYSEC-2014-67","https://plone.org/security/20131210/path-leak","http://www.openwall.com/lists/oss-security/2013/12/10/15","http://www.openwall.com/lists/oss-security/2013/12/12/3","https://github.com/advisories/GHSA-rg52-j87w-pf83"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2014-67","url":"https://osv.dev/vulnerability/PYSEC-2014-67"}],"summary":"Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initiali"}