Description
Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | zope2.7 | 2.7.5-2sarge2 | DSA-1113 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | zope2 | >= 2.7.0, < 2.7.8 | 2.7.8 | GHSA-jcjp-qqpq-pc54 |
| PyPI | zope2 | >= 2.8.0, < 2.8.7 | 2.8.7 | GHSA-jcjp-qqpq-pc54 |
| PyPI | zope2 | >= 2.9.0, < 2.9.3 | 2.9.3 | GHSA-jcjp-qqpq-pc54 |
Advisories 1
- DSA-1113 zope2.7 - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- 21025 third-party-advisory
- zope-docutils-information-disclosure(27636) vdb-entry
- http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-20060705/README.txt
- ADV-2006-2681 vdb-entry
- 21130 third-party-advisory
- 21459 third-party-advisory
- SUSE-SR:2006:019 vendor-advisory
- DSA-1113 vendor-advisory
- 18856 vdb-entry
- 20988 third-party-advisory
- [Zope-announce] 20060706 Serious security problem with Zope 2 mailing-list
- USN-317-1 vendor-advisory