VYPR
← All advisories
High severityNVD Advisory· Published Jan 12, 2008· Updated Apr 23, 2026

CVE-2008-0252

CVE-2008-0252

Description

Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cherrypyPyPI
< 2.1.12.1.1
cherrypyPyPI
>= 3.0, < 3.0.23.0.2

Affected products

1

Patches

1
37b856eba6f2

3.0.x fix for #744 (Malicious cookies may allow access to files outside the session directory).

https://github.com/cherrypy/cherrypyRobert BrewerOct 27, 2007via ghsa
commit
1 file changed · +4 −1
  • cherrypy/lib/sessions.py+4 −1 modified
    @@ -260,7 +260,10 @@ def setup(self):
                     os.path.abspath(self.storage_path)))
     
     def _get_file_path(self):
-        return os.path.join(self.storage_path, self.SESSION_PREFIX + self.id)
+        f = os.path.join(self.storage_path, self.SESSION_PREFIX + self.id)
+        if not os.path.normpath(f).startswith(self.storage_path):
+            raise cherrypy.HTTPError(400, "Invalid session id in cookie.")
+        return f
     
     def _load(self, path=None):
         if path is None:

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

29

News mentions

0

No linked articles in our index yet.