# CVE-2021-32807: Zope AccessControl remote code execution via Formatter class in Python 3

Source: https://junglewise.ai/threats/cve-2021-32807-zope-accesscontrol-remote-code-execution-via-formatter-class-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-08-05. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2021-32807 · Severity: medium · CVSS 4.4 · Published 2021-08-05

Zope AccessControl is a security component used to restrict what Python code can do within Zope web applications. A vulnerability was found where an attacker with administrative 'Manager' privileges could bypass these restrictions by using specific Python formatting tools to access unauthorized system libraries. This could allow the attacker to execute arbitrary code on the server, potentially leading to a full system takeover, though it requires high-level access to exploit.

Technologies: [AccessControl (PyPI)](https://junglewise.ai/threats/technologies/accesscontrol), [Zope (PyPI)](https://junglewise.ai/threats/technologies/zope). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-32807 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-32807 being exploited in the wild.

**How severe is CVE-2021-32807?** Medium severity, with a CVSS score of 4.4, published 5 August 2021.

**Which products and versions are affected?** AccessControl (PyPI) ECOSYSTEM:introduced=4.0,fixed=4.3, GIT:introduced=0,fixed=b42dd4badf803bb9fb71ac34cd9cb0c249262f2c|ECOSYSTEM:introduced=4.0,fixed=4.3,introduced=5.0,fixed=5.2; Zope (PyPI) ECOSYSTEM:introduced=4.0,fixed=4.3, GIT:introduced=0,fixed=b42dd4badf803bb9fb71ac34cd9cb0c249262f2c|ECOSYSTEM:introduced=4.0,fixed=4.3,introduced=5.0,fixed=5.2.

**Is there a fix for CVE-2021-32807?** Yes. AccessControl (PyPI): upgrade to 4.3, 5.2 or later; Zope (PyPI): upgrade to 4.3, 5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-32807 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-32807?** Check whether you run AccessControl (PyPI) or Zope (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- AccessControl (PyPI): upgrade to 4.3, 5.2 or later

  ```sh
  pip install "AccessControl>=5.2"
  ```

- Zope (PyPI): upgrade to 4.3, 5.2 or later

  ```sh
  pip install "Zope>=5.2"
  ```


## Technical details

The AccessControl module in Zope fails to properly sandbox restricted Python code when running on Python 3. While it restricts most modules, it permits the 'string' module, which includes the 'Formatter' class. An attacker can override and extend this class within a 'Script (Python)' object to break out of the restricted environment and access unsafe Python libraries. This vulnerability specifically affects environments running Python 3 (Python 2.7 is unaffected). Exploitation requires the 'Manager' role to add or edit scripts through the web interface. The issue is addressed in AccessControl versions 4.3 and 5.2.

## Affected products

- Zope Foundation AccessControl >= 4.0, < 4.3; >= 5.0, < 5.2
- Zope Foundation Zope >= 4.0, < 4.3; >= 5.0, < 5.2

## Identifiers

- CVE-2021-32807
- GHSA-qcx9-j53g-ccgf
- PYSEC-2021-335
- PYSEC-2021-875

## Timeline

- 2021-07-30: disclosed
- 2021-07-30: patched
- 2021-08-05: advisory

## References

- [https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf](https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf)
- [https://github.com/zopefoundation/AccessControl/commit/b42dd4badf803bb9fb71ac34cd9cb0c249262f2c](https://github.com/zopefoundation/AccessControl/commit/b42dd4badf803bb9fb71ac34cd9cb0c249262f2c)
- [https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst](https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst)
- [https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j8fr](https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j8fr)
- [https://github.com/zopefoundation/AccessControl/commit/ae2dab0cc34e6dd1561c5b12d4a56cd140f87e1d](https://github.com/zopefoundation/AccessControl/commit/ae2dab0cc34e6dd1561c5b12d4a56cd140f87e1d)

## Related threats

- [Zope AccessControl information disclosure via string format functions](https://junglewise.ai/threats/cve-2026-77401-zope-accesscontrol-information-disclosure-via-string-format)
- [PYSEC-2026-2326 - Access control vulnerable to user data deletion by anonynmous users](https://junglewise.ai/threats/cve-2024-51734-access-control-vulnerable-to-user-data-deletion-by-anonynmous)
- [PYSEC-2026-2325 - Information disclosure in AccessControl](https://junglewise.ai/threats/cve-2023-41050-information-disclosure-in-accesscontrol)
- [PYSEC-2026-2077 - Zope vulnerable to Stored Cross Site Scripting with SVG images](https://junglewise.ai/threats/cve-2023-42458-zope-vulnerable-to-stored-cross-site-scripting-with-svg-images)
- [PYSEC-2026-760 - Zope DocumentTemplate package allows unauthenticated write](https://junglewise.ai/threats/cve-2000-0483-zope-documenttemplate-package-allows-unauthenticated-write)