Description
Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cherrypy3 | 3.0.2-2 | — |
| Debian 13 | cherrypy3 | 3.0.2-2 | — |
| Debian 12 | cherrypy3 | 3.0.2-2 | — |
| Debian 4.0 | python-cherrypy | 2.2.1-3etch1 | DSA-1481-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cherrypy | < 2.1.1 | 2.1.1 | GHSA-76x8-gg39-5jjg |
| PyPI | cherrypy | >= 3.0, < 3.0.2 | 3.0.2 | GHSA-76x8-gg39-5jjg |
| PyPI | cherrypy | < 2.1.1 · >= 3.0, < 3.0.2 | 2.1.1, 3.0.2 | PYSEC-2008-3 |
Advisories 1
- DSA-1481-1 python-cherrypy - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.cherrypy.org/changeset/1775
- ADV-2008-0039 vdb-entry
- GLSA-200801-11 vendor-advisory
- 27181 vdb-entry
- DSA-1481 vendor-advisory
- https://bugs.gentoo.org/show_bug.cgi?id=204829
- http://www.cherrypy.org/changeset/1776
- http://www.cherrypy.org/changeset/1774
- https://issues.rpath.com/browse/RPL-2127
- 20080124 rPSA-2008-0030-1 CherryPy mailing-list
- FEDORA-2008-0333 vendor-advisory
- 28769 third-party-advisory
- http://www.cherrypy.org/ticket/744
- 28353 third-party-advisory
- 28611 third-party-advisory
- 28354 third-party-advisory
- 28620 third-party-advisory
- FEDORA-2008-0299 vendor-advisory