PyAMF vulnerable to XML external entity (XXE)

HIGH 7.1CVE-2015-8549 · GHSA-m7m4-4vm8-55wg · PYSEC-2020-339 · Published 15/01/2020 · updated 17/06/2026

In short

CVE-2015-8549 is a HIGH (CVSS 7.1) vulnerability affecting pyamf, pyamf (pyamf).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.3% of all vulnerabilities.
Fix: update to 0.8.0 or later.

Package	Affected versions	Patched versions
pyamf PyPI	`< 0.8.0`	`0.8.0`
pyamf pyamf	`< 0.8.0`	`0.8.0`

Description

PyAMF provides Action Message Format (AMF) support for Python that is compatible with the Adobe Flash Player. It includes integration with Python web frameworks like Django, Pylons, Twisted, SQLAlchemy, web2py and more. XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.

NVD description

XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.

References

nvd.nist.gov/vuln/detail/CVE-2015-8549 · ADVISORY
hydralabs/pyamf#58 · WEB
GitHub Advisory GHSA-m7m4-4vm8-55wg · ADVISORY
hydralabs/pyamf · PACKAGE
hydralabs/pyamf release v0.8.0 · WEB
pypa/advisory-database · WEB
pypi.org/project/pyamf · WEB
ocert.org/advisories/ocert-2015-011.html · WEB
securityfocus.com/archive/1/archive/1/537151/100/0/threaded · Broken Link

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pyamf

PyPI

< 0.8.0

0.8.0

pyamf

< 0.8.0

0.8.0

Description

NVD description

XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.