# CVE-2021-32674: Zope RCE via traversal in TAL expressions

Source: https://junglewise.ai/threats/cve-2021-32674-zope-rce-via-traversal-in-tal-expressions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-06-08. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2021-32674 · Severity: high · CVSS 8.8 · Published 2021-06-08

Zope is an open-source web application server. A vulnerability in its page templating system allows users with certain permissions to bypass security restrictions and execute arbitrary code on the server. This could lead to a complete system takeover, data theft, or service disruption, particularly in environments where untrusted users are granted template editing privileges.

Technologies: [Zope (PyPI)](https://junglewise.ai/threats/technologies/zope). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-32674 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-32674 being exploited in the wild.

**How severe is CVE-2021-32674?** High severity, with a CVSS score of 8.8, published 8 June 2021.

**Which products and versions are affected?** Zope (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.1, ECOSYSTEM:introduced=5.0,fixed=5.2.1, GIT:introduced=0,fixed=1d897910139e2c0b11984fc9b78c1da1365bec21|ECOSYSTEM:introduced=4.0,fixed=4.6.1,introduced=5.0,fixed=5.2.1.

**Is there a fix for CVE-2021-32674?** Yes. Zope (PyPI): upgrade to 4.6.1, 5.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-32674 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-32674?** Check whether you run Zope (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Zope (PyPI): upgrade to 4.6.1, 5.2.1 or later

  ```sh
  pip install "Zope>=5.2.1"
  ```


## Technical details

A Remote Code Execution (RCE) vulnerability exists in Zope due to improper path traversal limitations in Template Attribute Language (TAL) expressions. While Zope normally restricts access to sensitive Python modules like 'os' within templates, an attacker can bypass these restrictions by traversing through indirectly available modules. This allows an authenticated user with the ability to add or edit Zope Page Templates (typically requiring the 'Manager' role) to execute arbitrary Python code. The vulnerability is a continuation of a previous flaw (CVE-2021-32633) and has been addressed in Zope versions 4.6.1 and 5.2.1. Exploitation requires network access to the Zope management interface and valid credentials with template editing permissions.

## Affected products

- zopefoundation Zope < 4.6.1, >= 5.0, < 5.2.1

## Identifiers

- CVE-2021-32674
- GHSA-5vq5-pg3r-9ph3
- GHSA-rpcg-f9q6-2mq6
- PYSEC-2021-104

## Timeline

- 2021-05-21: other: Initial related vulnerability (GHSA-5pr9-v234-jw36) disclosed
- 2021-06-08: advisory: GHSA-rpcg-f9q6-2mq6 published
- 2021-06-08: patched: Fixes released in Zope 4.6.1 and 5.2.1

## References

- [https://github.com/zopefoundation/Zope/security/advisories/GHSA-rpcg-f9q6-2mq6](https://github.com/zopefoundation/Zope/security/advisories/GHSA-rpcg-f9q6-2mq6)
- [https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36](https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36)
- [https://github.com/zopefoundation/Zope/commit/1d897910139e2c0b11984fc9b78c1da1365bec21](https://github.com/zopefoundation/Zope/commit/1d897910139e2c0b11984fc9b78c1da1365bec21)
- [https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2021-104.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2021-104.yaml)
- [https://pypi.org/project/Zope](https://pypi.org/project/Zope)

## Related threats

- [PYSEC-2026-2326 - Access control vulnerable to user data deletion by anonynmous users](https://junglewise.ai/threats/cve-2024-51734-access-control-vulnerable-to-user-data-deletion-by-anonynmous)
- [PYSEC-2026-2325 - Information disclosure in AccessControl](https://junglewise.ai/threats/cve-2023-41050-information-disclosure-in-accesscontrol)
- [PYSEC-2026-2077 - Zope vulnerable to Stored Cross Site Scripting with SVG images](https://junglewise.ai/threats/cve-2023-42458-zope-vulnerable-to-stored-cross-site-scripting-with-svg-images)
- [PYSEC-2026-760 - Zope DocumentTemplate package allows unauthenticated write](https://junglewise.ai/threats/cve-2000-0483-zope-documenttemplate-package-allows-unauthenticated-write)
- [PYSEC-2026-761 - Zope Server vulnerable to DoS via header injection](https://junglewise.ai/threats/cve-2002-0687-zope-server-vulnerable-to-dos-via-header-injection)