High severity7.5NVD Advisory· Published Aug 23, 2021· Updated Jun 17, 2026

CVE-2021-39371

Description

An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
pywpsPyPI	< 4.5.0	4.5.0

Affected products

Osgeo/Owslib
cpe:2.3:a:osgeo:owslib:0.24.1:*:*:*:*:*:*:*
Osgeo/Pywps
cpe:2.3:a:osgeo:pywps:*:*:*:*:*:*:*:*
Range: <4.4.5
Debian/linux
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
PyWPS/PyWPSdescription
ghsa-coords
pkg:pypi/pywps
Range: < 4.5.0

Patches

Vulnerability mechanics

References

github.com/geopython/OWSLib/issues/790nvdIssue TrackingPatchThird Party AdvisoryWEB
github.com/geopython/pywps/pull/616nvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-p9wf-3xpg-c9g5ghsaADVISORY
lists.debian.org/debian-lts-announce/2021/09/msg00001.htmlnvdMailing ListThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2021-39371ghsaADVISORY
github.com/geopython/pywps/commit/7d6b26a2e931df2feca0b7fb24f4d01610825aeeghsaWEB
github.com/pypa/advisory-database/tree/main/vulns/pywps/PYSEC-2021-121.yamlghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000