Description
Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields".
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | albatross | 1.20-2 | DSA-942-1 |
Advisories 1
- DSA-942-1 albatross - design error Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-942 vendor-advisory
- ADV-2006-0196 vdb-entry
- 22451 vdb-entry
- 18496 third-party-advisory
- 18457 third-party-advisory
- http://www.object-craft.com.au/projects/albatross/news.html
- albatross-context-command-execution(24130) vdb-entry
- 16252 vdb-entry
- http://security.debian.org/pool/updates/main/a/albatross/albatross_1.20-2.diff.gz