CVE-2012-0878
Paste Script has improper group memberships permissions
CVE-2012-0878 is a medium vulnerability (CVSS 5.1) in Pythonpaste Paste, published May 1, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.03%, the 90th percentile. Fixed in pastescript 2.0.1.
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
Exploit likelihood
What each source reports
NVD Score used
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
CVE-2012-0878- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
CVE-2012-0878- Updated
- 2026-11-02
EUVDEUVD-2012-0025 No score
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
EUVD-2012-0025- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-27px-qpmj-qg38
Paste Script has improper group memberships permissions
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
GHSA-27px-qpmj-qg38- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-27px-qpmj-qg38
Paste Script has improper group memberships permissions
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
GHSA-27px-qpmj-qg38- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVPYSEC-2026-2859
Paste Script has improper group memberships permissions
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
PYSEC-2026-2859- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV No score
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
CVE-2012-0878- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-0878 No score
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
DEBIAN-CVE-2012-0878- Updated
- 2026-11-02
OSVPYSEC-2012-15 No score
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
PYSEC-2012-15- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pastescriptPyPI |
before 2.0.1 | 2.0.1 |
pastePyPI |
before 1.7.5.1 | 1.7.5.1 |
pastescriptDebian:12 |
before 1.7.5-2 | 1.7.5-2 |
pastescriptDebian:13 |
before 1.7.5-2 | 1.7.5-2 |
pastescriptDebian:14 |
before 1.7.5-2 | 1.7.5-2 |
pastescriptPyPI |
before 2.0.1, plus listed versions 0.30.3.10.40.4.10.4.2 Show 28 moreShow less0.50.5.10.90.9.60.9.70.9.81.01.11.31.3.11.3.21.3.31.3.41.3.51.3.61.61.6.11.6.1.11.6.21.6.31.71.7.21.7.31.7.41.7.4.11.7.4.21.7.52.0 |
2.0.1 |
pastePyPI |
before 1.7.5.1, plus listed versions 0.30.40.4.10.50.9 Show 28 moreShow less0.9.10.9.20.9.30.9.50.9.60.9.70.9.80.9.8.11.01.0.11.11.1.11.21.2.11.31.41.4.11.4.21.51.5.11.61.71.7.11.7.21.7.31.7.3.11.7.41.7.5 |
1.7.5.1 |
python-paste-scriptRed Hat:enterprise_linux:6::server |
before 0:1.7.3-5.el6_3 | 0:1.7.3-5.el6_3 |
python-paste-scriptRed Hat:enterprise_linux:6::workstation |
before 0:1.7.3-5.el6_3 | 0:1.7.3-5.el6_3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=796790
openwall.com/lists/oss-security/2012/02/23/1
bitbucket.org/ianb/pastescript/pull-request/3/fix-group-permissions-for-pastescriptserve
secunia.com/advisories/48812
rhn.redhat.com/errata/RHSA-2012-1206.html
Show 17 moreShow less
groups.google.com/group/paste-users/browse_thread/thread/2aa651ba331c2471
nvd.nist.gov/vuln/detail/CVE-2012-0878
github.com/cdent/pastescript/commit/b5f36f2995e1ae117cc53d2bd458d7fb33e4cabe
web.archive.org/web/20140723093519/http://secunia.com/advisories/50410
security-tracker.debian.org/tracker/CVE-2012-0878
pypi.org/project/pastescript
access.redhat.com/errata/RHSA-2012:1206
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1206.json
cve.org/CVERecord?id=CVE-2012-0878