CVE-2009-2701

Zope Object Database (ZODB) Arbitrary files reading and deletion

6.0 MediumFix available

Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.

Exploit likelihood

0.97%Down 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 6.0

Record: CVE-2009-2701
CVSS 2.0: 6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-2701
Updated: 2026-11-02

EUVDEUVD-2009-0011 No score

Record: EUVD-2009-0011
Updated: 2026-11-03

GitHub AdvisoriesGHSA-m52m-2qpx-9j4j 9.3

Zope Object Database (ZODB) Arbitrary files reading and deletion

Record: GHSA-m52m-2qpx-9j4j
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-m52m-2qpx-9j4j 9.3

Zope Object Database (ZODB) Arbitrary files reading and deletion

Record: GHSA-m52m-2qpx-9j4j
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVPYSEC-2009-10 No score

Record: PYSEC-2009-10
Updated: 2026-11-02

Affected products

zope zodb

Affected packages

Affected packages
Package	Affected	Fixed
`zodb3` PyPI	3.8 up to 3.8.3	3.8.3
`zodb3` PyPI	3.9a0 up to 3.9.0c2	3.9.0c2
`zodb3` PyPI	3.8 up to 3.8.3, plus listed versions 3.8.03.8.13.8.1b13.8.1b23.8.1b3 Show 8 moreShow less 3.8.1b43.8.1b53.8.1b63.8.1b73.8.1b83.8.1b93.8.23.8.3b1	3.8.3
`zodb3` PyPI	3.9a0 up to 3.9.0c2, plus listed versions 3.9.0a13.9.0a103.9.0a113.9.0a123.9.0a2 Show 12 moreShow less 3.9.0a33.9.0a43.9.0a53.9.0a63.9.0a73.9.0a93.9.0b13.9.0b23.9.0b33.9.0b43.9.0b53.9.0c1	3.9.0c2
`zodb3` PyPI	3.8 up to 3.8.3, 3.9a0 up to 3.9.0c2, plus listed versions 3.8.03.8.13.8.1b13.8.1b23.8.1b3 Show 25 moreShow less 3.8.1b43.8.1b53.8.1b63.8.1b73.8.1b83.8.1b93.8.23.8.3b13.9.0a13.9.0a103.9.0a113.9.0a123.9.0a23.9.0a33.9.0a43.9.0a53.9.0a63.9.0a73.9.0a93.9.0b13.9.0b23.9.0b33.9.0b43.9.0b53.9.0c1	3.8.33.9.0c2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-2701 is a medium vulnerability (CVSS 6.0) in Zope Zodb, published September 8, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in zodb3 3.8.3.