web2py remote code execution via hardcoded encryption key in session.connect function

CRITICAL 9.8CVE-2016-3953 · GHSA-q2rq-qgcf-m22w · PYSEC-2026-570 · Published 06/02/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
web2py PyPI	`< 2.14.2`	`2.14.2`
web2py web2py	`< 2.14.2`	`2.14.2`

Description

The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the session.connect function.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-3953 · ADVISORY
web2py/web2py · WEB
web2py/web2py commit 9706d12 · WEB
devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957 · WEB
web2py/web2py · PACKAGE
web2py/web2py · WEB
usn.ubuntu.com/4030-1 · WEB
devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957 · Exploit
usn.ubuntu.com/4030-1
pypi.org/project/web2py · PACKAGE
GitHub Advisory GHSA-q2rq-qgcf-m22w · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free