CVE-2023-40587
Pyramid static view path traversal up one directory
Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Pyramid static view path traversal up one directory
Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
- Record
CVE-2023-40587- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2023-2313
Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
- Record
EUVD-2023-2313- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j8g2-6fc7-q8f8
Pyramid static view path traversal up one directory
Impact
This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html.
Example:
config.add_static_view(name='static', path='/usr/src/app/static', cache_max_age=0)
And directory tree:
/usr/src/app \
| - static \
| - file.css
| - index.html
| - ...
| - index.html <-- (this file could be disclosed with this bug)
Patches
Pyramid now will reject any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories.
Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version, see:
At the time the following Python versions are not fixed:
- Python 3.11.0 to 3.11.4
- Python 3.12.0a1 to 3.12.0rc1
Fixes will be available in: Python 3.12.0rc2 or 3.11.5.
Please note that release candidates of Python are not production ready and should not be used for production workloads.
Workarounds
Use a version of Python 3 that is not affected. Downgrade to Python 3.10 series temporarily, or wait till Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
References
- https://owasp.org/www-community/attacks/Path_Traversal
- VN: JVN#41113329
- TN: JPCERT#93311166
Thanks
- Masashi Yamane of LAC Co., Ltd
- Record
GHSA-j8g2-6fc7-q8f8- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
- Record
CVE-2023-40587- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Pyramid static view path traversal up one directory
Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
- Record
CVE-2023-40587- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-40587
Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
- Record
DEBIAN-CVE-2023-40587- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-j8g2-6fc7-q8f8
Pyramid static view path traversal up one directory
Impact
This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html.
Example:
config.add_static_view(name='static', path='/usr/src/app/static', cache_max_age=0)
And directory tree:
/usr/src/app \
| - static \
| - file.css
| - index.html
| - ...
| - index.html <-- (this file could be disclosed with this bug)
Patches
Pyramid now will reject any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories.
Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version, see:
At the time the following Python versions are not fixed:
- Python 3.11.0 to 3.11.4
- Python 3.12.0a1 to 3.12.0rc1
Fixes will be available in: Python 3.12.0rc2 or 3.11.5.
Please note that release candidates of Python are not production ready and should not be used for production workloads.
Workarounds
Use a version of Python 3 that is not affected. Downgrade to Python 3.10 series temporarily, or wait till Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
References
- https://owasp.org/www-community/attacks/Path_Traversal
- VN: JVN#41113329
- TN: JPCERT#93311166
Thanks
- Masashi Yamane of LAC Co., Ltd
- Record
GHSA-j8g2-6fc7-q8f8- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVPYSEC-2026-1840
Pyramid static view path traversal up one directory
Impact
This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html.
Example:
config.add_static_view(name='static', path='/usr/src/app/static', cache_max_age=0)
And directory tree:
/usr/src/app \
| - static \
| - file.css
| - index.html
| - ...
| - index.html <-- (this file could be disclosed with this bug)
Patches
Pyramid now will reject any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories.
Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version, see:
At the time the following Python versions are not fixed:
- Python 3.11.0 to 3.11.4
- Python 3.12.0a1 to 3.12.0rc1
Fixes will be available in: Python 3.12.0rc2 or 3.11.5.
Please note that release candidates of Python are not production ready and should not be used for production workloads.
Workarounds
Use a version of Python 3 that is not affected. Downgrade to Python 3.10 series temporarily, or wait till Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
References
- https://owasp.org/www-community/attacks/Path_Traversal
- VN: JVN#41113329
- TN: JPCERT#93311166
Thanks
- Masashi Yamane of LAC Co., Ltd
- Record
PYSEC-2026-1840- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-40587
Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
- Record
UBUNTU-CVE-2023-40587- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyramidPyPI |
2.0.0 up to 2.0.2 | 2.0.2 |
python-pyramidDebian:12 |
before 2.0+dfsg-2+deb12u1, plus listed versions 2.0+dfsg-2 |
2.0+dfsg-2+deb12u1 |
python-pyramidDebian:13 |
before 2.0.2+dfsg-1 | 2.0.2+dfsg-1 |
python-pyramidDebian:14 |
before 2.0.2+dfsg-1 | 2.0.2+dfsg-1 |
pyramidPyPI |
2.0.0 up to 2.0.2, plus listed versions 2.02.0.1 |
2.0.2 |
python-pyramidUbuntu:16.04:LTS |
All versions, plus listed versions 1.5.1+dfsg-21.5.7+dfsg-11.6+dfsg-1 |
None known |
python-pyramidUbuntu:18.04:LTS |
All versions, plus listed versions 1.6+dfsg-11.6+dfsg-1.1 |
None known |
python-pyramidUbuntu:20.04:LTS |
All versions, plus listed versions 1.10.2+dfsg-21.10.4+dfsg-1 |
None known |
python-pyramidUbuntu:22.04:LTS |
All versions, plus listed versions 1.10.4+dfsg-22.0+dfsg-1 |
None known |
python-pyramidUbuntu:24.04:LTS |
All versions, plus listed versions 2.0+dfsg-2 |
None known |
python-pyramidUbuntu:25.10 |
All versions, plus listed versions 2.0.2+dfsg-1 |
None known |
python-pyramidUbuntu:26.10 |
All versions, plus listed versions 2.0.2+dfsg-12.0.2+dfsg-2 |
None known |
python-pyramidUbuntu:26.04:LTS |
All versions, plus listed versions 2.0.2+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-40587 is a medium vulnerability (CVSS 4.3) in Agendaless Pyramid, published August 25, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in pyramid 2.0.2.
References
github.com/Pylons/pyramid/security/advisories/GHSA-j8g2-6fc7-q8f8
lists.fedoraproject.org/archives/list/[email protected]/message/OQIPHQTM3XE5NIEXCTQFV2J2RK2YUSMT
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-40587
security-tracker.debian.org/tracker/CVE-2023-40587
pypi.org/project/pyramid
ubuntu.com/security/CVE-2023-40587
cve.org/CVERecord?id=CVE-2023-40587