High severity7.8OSV Advisory· Published Feb 6, 2018· Updated Jun 17, 2026

CVE-2016-3952

Description

web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify. NOTE: this issue can be leveraged by remote attackers to gain administrative access.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Web2py/Web2pyOSV2 versions
R-2.10.1, R-2.10.2, R-2.10.3, …+ 1 more
- (no CPE)range: R-2.10.1, R-2.10.2, R-2.10.3, …
- (no CPE)range: <2.14.1

Patches

Vulnerability mechanics

References

devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/nvdExploitTechnical DescriptionThird Party Advisory
github.com/web2py/web2py/commit/9706d125b42481178d2b423de245f5d2faadbf40nvdThird Party Advisory
usn.ubuntu.com/4030-1/nvd

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000