Directory Traversal in web2py Admin Module

Executive Summary

CVE-2026-79318 is a path traversal vulnerability in web2py 3.2.2-stable affecting the administrative application. It allows authenticated users to read or write files outside the intended directory due to improper path handling in read_file()/write_file() functions. This flaw, tracked as CWE-22, enables access to sensitive files or overwriting critical ones, potentially leading to arbitrary code execution if files are written to controller directories.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your web2py instance is running version 3.2.2 or earlier. Inspect the administrative interface for unauthorized file access attempts or suspicious file read/write operations. Monitor logs for paths containing parent directory traversal sequences like '../' in requests to webservices.py.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers with valid credentials to access sensitive files like configuration files, source code, or password hashes. It may also enable overwriting critical files, which could lead to arbitrary code execution. The impact depends on the attacker's access level and the files they can reach.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files such as configuration files, source code, or password hashes, which may contain personal or protected health information. Unauthorized access to such data could result in violations of GDPR (if personal data is exposed) or HIPAA (if protected health information is compromised). The ability to read or write files outside intended directories increases the risk of non-compliance with these regulations due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the administrative interface via network controls or TLS reverse proxies. Disable remote file operations if not required. Upgrade to a patched development version if available. Implement strict path containment checks in file operations. Ensure strong credentials are enforced for all administrative accounts.

Useful 0 Not Useful 0