zopefoundation AccessControl up to 7.3 Python Formatting ImplPython.py str.format/str.format_map format string

Summaryinfo

A vulnerability categorized as problematic has been discovered in zopefoundation AccessControl up to 7.3. This vulnerability affects the function str.format/str.format_map of the file ImplPython.py of the component Python Formatting. Such manipulation leads to format string. This vulnerability is referenced as CVE-2026-77401. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in zopefoundation AccessControl up to 7.3. It has been rated as problematic. Affected by this issue is the function str.format/str.format_map of the file ImplPython.py of the component Python Formatting. The manipulation with an unknown input leads to a format string vulnerability. Using CWE to declare the problem leads to CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. Impacted is confidentiality. CVE summarizes:

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.format_map when those methods are reached through a str subclass. In both ImplPython.py and cAccessControl.c, Python formatting can recursively access attributes and subscriptions using unrestricted getattr and getitem behavior instead of the policy-restricted getattr and getitem operations. A controlled format string can therefore disclose objects reachable from values available to the formatting operation. This issue is fixed in version 7.4.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-77401 since 08/20/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation requires an enhanced level of successful authentication. There are known technical details, but no exploit is available.

Upgrading to version 7.4 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• zopefoundation

Name

• AccessControl

Version

• 7.0
• 7.1
• 7.2
• 7.3

Website

• Product: https://github.com/zopefoundation/AccessControl/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion