Description

web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-21T20:17:32.510Z",
  "pubdate": "2026-09-21T20:17:32.510Z",
  "executiveSummary": "A directory traversal vulnerability has been identified in web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d).\nThe vulnerability resides within the read_file() and write_file() functions located in applications/admin/controllers/webservices.py.\nThis security flaw allows an unauthenticated or authenticated attacker, depending on the environment configuration, to manipulate file paths and access arbitrary files on the underlying filesystem.\nBy bypassing intended directory restrictions, an attacker can read sensitive configuration files, source code, or internal data, or potentially overwrite files to achieve remote code execution or system compromise.\nThe impact is high, as it enables unauthorized disclosure of sensitive information and potential full system compromise, depending on the privileges of the web application process.\nThe vulnerability is caused by improper validation of user-supplied input used in file path construction, failing to neutralize directory traversal sequences.",
  "technicalDetails": "The vulnerability is located in the administration interface of web2py, specifically within the webservices.py controller, which handles file system operations for application management.\nThe root cause is insufficient sanitization of input parameters passed to the read_file() and write_file() functions. These functions fail to properly validate or normalize file paths, allowing the use of traversal sequences such as '../' to escape the designated application directory context.\nWhen a user invokes these functions, the application constructs a file system path based on user-provided input without enforcing a strict root directory jail. This allows an attacker to manipulate the file path traversal to access sensitive files outside the intended web application directory.\nIn a typical attack scenario, an adversary provides a crafted input containing traversal sequences (e.g., '../../../../etc/passwd') as an argument to the affected functions. The web2py framework resolves this path and performs the requested operation (read or write) on the target file.\nIf exploited via read_file(), the application returns the contents of the target file to the user. This can lead to the exposure of credentials, database configurations, application source code, and other sensitive system files.\nIf exploited via write_file(), an attacker may be able to overwrite critical system files or upload malicious files to locations where they can be executed by the web server, leading to potential Remote Code Execution (RCE).\nThis vulnerability is particularly critical in environments where the web2py admin interface is accessible over a network. The exploitation is trivial and does not require complex payloads, merely the injection of standard traversal characters.\nThe impact is significant, as it effectively breaks the filesystem boundary intended for the web application, granting the attacker the same file access permissions as the web server process itself."
}