JVN#41113329: Pyramid vulnerable to directory traversal

Pyramid provided by Pylons Project, which is a web framework for Python, contains a directory traversal vulnerability (CWE-22).

Impact

index.html located one directory above the location of the static view’s file system path can be accessed via a crafted request.

Solution

Update the software
Update the software according to the information provided by the developer.

For more information, refer to the information provided by the developer.

Products Affected

Applications created with the following versions of Pyramid are affected when they are deployed with Python 3.11.0 to 3.11.4:

• Pyramid versions 2.0.0 and 2.0.1