Zope Object Database (ZODB) Arbitrary files reading and deletion

MEDIUM 6.0CVE-2009-2701 · GHSA-m52m-2qpx-9j4j · PYSEC-2009-10 · Published 08/09/2009 · updated 16/06/2026

In short

CVE-2009-2701 is a MEDIUM (CVSS 6.0) vulnerability affecting zodb3, zodb (zope).
Chance of exploitation in the next 30 days (EPSS): 0.97%, higher than 61.9% of all vulnerabilities.
Fix: update to 3.8.3, 3.9.0c2 or later.

Package	Affected versions	Patched versions
zodb3 PyPI	`≥ 3.8, < 3.8.3≥ 3.9a0, < 3.9.0c2`	`3.8.33.9.0c2`
zodb zope	`= 3.8= 3.8.0= 3.8.1= 3.8.2= 3.9.0= 3.9.0b1= 3.9.0b2= 3.9.0b3= 3.9.0b4= 3.9.0b5= 3.9.0c1`	No fix yet

Description

Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2009-2701 · ADVISORY
pypa/advisory-database · WEB
zopefoundation/ZODB3 · PACKAGE
mail.zope.org/pipermail/zope-announce/2009-September/002221.html · WEB
pypi.python.org/pypi/ZODB3/3.8.3 · WEB
pypi.python.org/pypi/ZODB3/3.9.0c2 · WEB
vupen.com/english/advisories/2009/2534 · Patch
GitHub Advisory GHSA-m52m-2qpx-9j4j · ADVISORY

More vulnerabilities in zodb3

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

zodb3

PyPI

≥ 3.8, < 3.8.3≥ 3.9a0, < 3.9.0c2

3.8.33.9.0c2

zodb

zope

= 3.8= 3.8.0= 3.8.1= 3.8.2= 3.9.0= 3.9.0b1= 3.9.0b2= 3.9.0b3= 3.9.0b4= 3.9.0b5= 3.9.0c1

No fix yet

Description

NVD description

More vulnerabilities in zodb3

See all →