CVE-2023-40587

Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a `index.html` file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is `index.html`. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in `os.path.normpath` to no longer truncate on the first `0x00` found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.

• CWE-22
• CWE-22

• https://github.com/Pylons/pyramid/commit/347d7750da6f45c7436dd0c31468885cc9343c85Patch
• https://github.com/Pylons/pyramid/security/advisories/GHSA-j8g2-6fc7-q8f8Patch, Vendor Advisory
• https://github.com/python/cpython/issues/106242Issue Tracking, Third Party Advisory
• https://github.com/python/cpython/pull/106816Patch
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYSDTQ7NP5GHPQ7HBE47MBJQK7YEIYMF/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQIPHQTM3XE5NIEXCTQFV2J2RK2YUSMT/Mailing List
• https://github.com/Pylons/pyramid/commit/347d7750da6f45c7436dd0c31468885cc9343c85Patch
• https://github.com/Pylons/pyramid/security/advisories/GHSA-j8g2-6fc7-q8f8Patch, Vendor Advisory
• https://github.com/python/cpython/issues/106242Issue Tracking, Third Party Advisory
• https://github.com/python/cpython/pull/106816Patch
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYSDTQ7NP5GHPQ7HBE47MBJQK7YEIYMF/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQIPHQTM3XE5NIEXCTQFV2J2RK2YUSMT/Mailing List

Published

Aug 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40581yt-dlp is a youtube-dl fork with additional features and fix…7.8
• CVE-2023-40582find-exec is a utility to discover available shell commands.…9.8
• CVE-2023-40583libp2p is a networking stack and library modularized out of …7.5
• CVE-2023-40584Argo CD is a declarative continuous deployment for Kubernete…6.5
• CVE-2023-40585ironic-image is a container image to run OpenStack Ironic as…7.5
• CVE-2023-40586OWASP Coraza WAF is a golang modsecurity compatible web appl…7.5
• CVE-2023-40588Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-40589FreeRDP is a free implementation of the Remote Desktop Proto…7.5
• CVE-2023-4059The Profile Builder WordPress plugin before 3.9.8 lacks auth…4.3
• CVE-2023-40590 GitPython is a python library used to interact with Git rep…7.8
• CVE-2023-40591go-ethereum (geth) is a golang execution layer implementatio…7.5
• CVE-2023-40592In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12…6.1