CVE-2023-45158

9.8 criticalEPSS 4.4%

Critical (9.8) in web2py web2py. EPSS 4.4% chance of exploitation in the next 30 days.

An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.4% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2023-10-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

web2py:web2py

References

http://web2py.com/
http://web2py.com/init/default/download
https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3
https://jvn.jp/en/jp/JVN80476432/
http://web2py.com/

Check your stack JSON