Critical severity9.8OSV Advisory· Published Feb 6, 2018· Updated Jun 17, 2026

CVE-2016-3957

Description

The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to execute arbitrary code by leveraging knowledge of encryption_key.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Web2py/Web2pyOSV2 versions
R-2.10.1, R-2.10.2, R-2.10.3, …+ 1 more
- (no CPE)range: R-2.10.1, R-2.10.2, R-2.10.3, …
- (no CPE)range: <2.14.2
Ubuntu/Ubuntullm-fuzzy
Range: unknown

Patches

Vulnerability mechanics

References

devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/nvdExploitTechnical DescriptionThird Party Advisory
github.com/web2py/web2py/blob/R-2.14.1/gluon/utils.pynvdThird Party Advisory
usn.ubuntu.com/4030-1/nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.004
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000