CVE-2008-0252
cherrypy cherrypy: no CVSS score yet. EPSS 2.7% chance of exploitation in the next 30 days. Fixed in cherrypy 2.1.1, 3.0.2.
Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.
- EPSS
- 2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cherrypy:cherrypy
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-76x8-gg39-5jjg | PyPI | cherrypy | <2.1.1 | 2.1.1 |
| GHSA-76x8-gg39-5jjg | PyPI | cherrypy | >=3.0 <3.0.2 | 3.0.2 |
| PYSEC-2008-3 | PyPI | cherrypy | <2.1.1 >=3.0 <3.0.2 | 2.1.1, 3.0.2 |