CVE-2021-32811

Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional `Products.PythonScripts` add-on package installed. By default, one must have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. Zope releases 4.6.3 and 5.3 are not vulnerable. As a workaround, a site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.

• CWE-915
• CWE-1321

• https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgfThird Party Advisory
• https://github.com/zopefoundation/Zope/commit/f72a18dda8e9bf2aedb46168761668464a4be988Patch, Third Party Advisory
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j8frThird Party Advisory
• https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgfThird Party Advisory
• https://github.com/zopefoundation/Zope/commit/f72a18dda8e9bf2aedb46168761668464a4be988Patch, Third Party Advisory
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j8frThird Party Advisory

Published

Aug 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32806Products.isurlinportal is a replacement for isURLInPortal me…6.1
• CVE-2021-32807The module `AccessControl` defines security policies for Pyt…7.2
• CVE-2021-32808ckeditor is an open source WYSIWYG HTML editor with rich con…5.4
• CVE-2021-32809ckeditor is an open source WYSIWYG HTML editor with rich con…5.4
• CVE-2021-3281In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 befo…5.3
• CVE-2021-32810crossbeam-deque is a package of work-stealing deques for bui…9.8
• CVE-2021-32812Monkshu is an enterprise application server for mobile apps …6.1
• CVE-2021-32813Traefik is an HTTP reverse proxy and load balancer. Prior to…8.1
• CVE-2021-32814Skytable is a NoSQL database with automated snapshots and TL…8.1
• CVE-2021-32815Exiv2 is a command-line utility and C++ library for reading,…5.5
• CVE-2021-32816ProtonMail Web Client is the official AngularJS web client f…7.5
• CVE-2021-32817express-hbs is an Express handlebars template engine. expres…6.8