Executive brief
web2py is a full-stack web framework that includes an administrative interface for editing application code and managing deployments. An authenticated attacker with access to the admin interface can read arbitrary files from the server (including password hashes and configuration) and write files to any location the process can access, such as application controller directories. This allows complete compromise of the web2py deployment when the admin interface is exposed remotely over HTTPS as documented.
Technical details
The path construction helper in the admin application's JSON-RPC file read and write methods (read_file() and write_file() in applications/admin/controllers/webservices.py) fails to validate that resolved paths remain within the application root directory. The function resolves parent-directory segments and joins them with the application directory without checking the final result, allowing attackers to traverse outside the intended directory scope. Exploitation requires a valid administrative credential and HTTPS for remote access due to the channel gate that blocks plaintext requests from non-loopback addresses.
Affected products
- web2py web2py 3.2.2-stable and earlier, including 3.3.3 as of 2026-04-28
Timeline
- 2026-09-21: disclosed: CVE-2026-79318 published
- 2026-07-31: other: Vulnerability reported; confirmed by live reproduction on web2py 3.2.2