{"id":"CVE-2006-3458","aliases":["DEBIAN-CVE-2006-3458","DSA-1113","EUVD-2006-0006","GHSA-jcjp-qqpq-pc54","PYSEC-2006-7"],"status":"published","title":"Zope allows local users to read arbitrary files","description":"Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the \"raw\" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00422,"percentile":0.36784,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2006-07-07T23:00:00Z","modified":"2026-06-16T22:27:05Z","fixes":[{"ecosystem":"PyPI","package":"zope2","fixed_in":["2.7.8","2.8.7","2.9.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:3.1","package":"zope2.7","fixed_in":["2.7.5-2sarge2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"zope2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"zope2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.7"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"zope2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.3"}]}]},{"source":"osv","ecosystem":"Debian:3.1","package":"zope2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-2sarge2"}]}],"versions":["2.7.5-2","2.7.5-2sarge1"]},{"source":"osv","ecosystem":"PyPI","package":"zope2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"zope2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"zope2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.3"}]}]}],"products":[{"vendor":"zope","product":"zope"}],"references":[{"url":"http://secunia.com/advisories/21025","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27636","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-20060705/README.txt","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2006/2681","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/21130","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/21459","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.novell.com/linux/security/advisories/2006_19_sr.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web","advisory"]},{"url":"http://www.debian.org/security/2006/dsa-1113","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web","advisory"]},{"url":"http://www.securityfocus.com/bid/18856","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://secunia.com/advisories/20988","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://mail.zope.org/pipermail/zope-announce/2006-July/001984.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://usn.ubuntu.com/317-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3458","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2006-7.yaml","tags":["web"]},{"url":"https://usn.ubuntu.com/317-1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jcjp-qqpq-pc54","tags":["advisory"]},{"url":"https://github.com/zopefoundation/Zope","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2006-3458","description":"Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the \"raw\" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.","status":"published","published":"2006-07-07T23:00:00Z","modified":"2024-08-07T18:30:33.592Z","updated_at":"2026-11-02T14:33:49.62488Z"}],"euvd":[{"id":"EUVD-2006-0006","description":"Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the \"raw\" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.","status":"published","published":"2006-07-07T23:00:00Z","modified":"2024-08-07T18:30:33Z","updated_at":"2026-11-03T01:15:56.357298Z"}],"ghsa":[{"id":"GHSA-jcjp-qqpq-pc54","title":"Zope allows local users to read arbitrary files","description":"Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the \"raw\" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.","status":"published","published":"2022-05-01T07:09:18Z","modified":"2024-11-21T22:13:09Z","updated_at":"2026-11-02T14:38:21.777721Z"}],"nvd":[{"id":"CVE-2006-3458","description":"Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the \"raw\" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.","status":"published","published":"2006-07-07T23:05:00Z","modified":"2026-06-16T22:27:05.933Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:01:04.288594Z"}],"osv":[{"id":"DSA-1113","title":"zope2.7 - programming error","status":"published","published":"2006-07-18T00:00:00Z","modified":"2026-03-09T01:01:43.380264Z","updated_at":"2026-11-02T15:46:14.285228Z"},{"id":"GHSA-jcjp-qqpq-pc54","title":"Zope allows local users to read arbitrary files","description":"Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the \"raw\" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.","status":"published","published":"2022-05-01T07:09:18Z","modified":"2024-11-22T05:12:32.910339Z","updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"PYSEC-2006-7","description":"Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the \"raw\" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.","status":"withdrawn","published":"2006-07-07T23:05:00Z","modified":"2026-06-10T17:00:28.526859224Z","updated_at":"2026-11-02T15:52:51.254177Z"}]}}