Executive brief
Zope AccessControl is a security layer that controls how Python code can access objects in applications built on Zope. An attacker who can create and execute Python code can exploit Python's string formatting functions (format and format_map) to bypass access restrictions and read sensitive data from protected objects. This affects organizations using Zope with untrusted code execution features.
Technical details
The vulnerability is a protection mechanism bypass (CWE-693) in the Zope AccessControl package. Python's string format and format_map functions allow attribute access and item subscription through format specifiers, but these accesses use Python's built-in getattr and getitem rather than AccessControl's restricted _getattr_ and _getitem_ variants. While AccessControl guards against direct calls to format/format_map on string instances, the protection did not cover subclasses of str. An attacker with the ability to execute Python code controlled by AccessControl can craft a format string using a str subclass to recursively access and read protected object attributes. The vulnerability requires high privileges (ability to write untrusted code) but has network-accessible vectors and changes security scope (C:H). A patch is available in version 7.4.
Affected products
- Zope Foundation AccessControl < 7.4
Timeline
- 2026-07-20: disclosed: Published by GitHub Advisory Database
- 2026-07-20: patched: Fix released in version 7.4
- 2026-09-17: advisory: GHSA-pq59-9fq7-m886 published