CVE-2026-79318 in web2py
Summary
by MITRE • 09/21/2026
web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in web2py versions prior to 3.2.2-stable, specifically stemming from commit a7330a2bf21219fa77860b6665de927dd4f98e6d, represents a critical directory traversal flaw within the administrative web services module. This security defect is located in the read_file and write_file functions found in applications/admin/controllers/webservices.py. The core issue arises from insufficient validation of user-supplied input when constructing file paths for reading or writing content on the server's filesystem. An attacker can exploit this lack of sanitization by manipulating path parameters to include directory traversal sequences, such as dot-dot-slash characters, which allow navigation outside the intended application directories into arbitrary locations on the host system.
From a technical perspective, the flaw aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The web2py framework provides administrative APIs that are designed for managing applications and configurations within its controlled environment. However, when these endpoints accept file paths without rigorous normalization or restriction checks, they inadvertently expose the underlying operating system's filesystem structure. By injecting relative path traversal sequences into the filename parameter, an attacker can bypass the expected sandboxing of the web2py application directory. This allows access to files that are typically protected from direct user interaction, including configuration files containing database credentials, private keys, or other sensitive data stored in parent directories or system paths accessible by the process running the web server.
The operational impact of this vulnerability is severe, particularly for deployments where administrative interfaces are exposed to untrusted networks or lack robust access controls. Successful exploitation enables an attacker to perform unauthorized file reads, leading to information disclosure that can compromise the entire infrastructure. If write capabilities are enabled and accessible through these endpoints, the risk escalates significantly. An adversary could overwrite critical system files, inject malicious code into existing scripts, or create new executable files in sensitive directories. This capability effectively grants remote code execution potential depending on how the server processes subsequent requests involving those manipulated files, thereby turning a simple file read/write flaw into a full compromise of the application's integrity and confidentiality.
This vulnerability is also closely related to CWE-73: External Control of File Name or Path, as it involves external input directly influencing the path used for file operations without adequate validation against an allowlist of permitted directories. In terms of offensive security frameworks, this exploitation technique maps to ATT&CK T1083: File and Directory Discovery, where adversaries enumerate files to gather intelligence, and potentially T1564: Hidden Files and Directories if the traversal is used to access hidden system configurations. The lack of strict path canonicalization allows these techniques to be executed with minimal detection by standard web application firewalls that may not inspect for deep directory traversal patterns in API parameters.
Mitigation strategies must focus on immediate patching and defensive coding practices. Administrators should upgrade immediately to the fixed version of web2py where this commit has been addressed, ensuring that input validation is strictly enforced within the webservices controller. For environments unable to update instantly, network-level controls such as Web Application Firewalls can be configured to block requests containing directory traversal sequences in file-related parameters. Additionally, developers should implement strict allowlisting for all file paths passed to read and write functions, ensuring that only files within designated application directories are accessible. Implementing principle of least privilege for the web server process user account further limits the damage potential by restricting access to sensitive system-level files regardless of traversal attempts.