CVE-2026-79310: web.py SSTI RCE Vulnerability

CVE-2026-79310 Overview

CVE-2026-79310 is a server-side template injection (SSTI) vulnerability in webpy web.py version 0.76. The template engine can be manipulated into executing attacker-controlled template code that the built-in security checks are designed to reject. When an application precompiles templates from a directory an attacker can write to, then later renders them through the precompiled template loader, the sandbox is bypassed. This results in arbitrary Python code execution and operating system command execution on the underlying server. The flaw is categorized under CWE-94: Improper Control of Generation of Code.

Critical Impact

Attackers with write access to the template precompilation directory can execute arbitrary Python and OS commands on the server, leading to full application compromise.

Affected Products

• webpy web.py version 0.76
• Applications using the webpy precompiled template loader
• Deployments where template source directories are attacker-writable

Discovery Timeline

• 2026-09-23 - CVE-2026-79310 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-79310

Vulnerability Analysis

The webpy templating system (web.template) provides a sandbox intended to prevent template code from importing arbitrary modules or executing system commands. The sandbox performs security checks during template parsing and compilation to reject dangerous constructs.

The vulnerability arises because these checks are enforced at compile time rather than at load time. When templates are precompiled from a directory and stored on disk, the resulting compiled artifacts are later loaded and executed without re-validation. An attacker who can write files into the precompilation directory can inject malicious template code that bypasses the sandbox entirely.

Once the precompiled template is rendered by the application, the injected payload executes with the privileges of the web server process. This yields arbitrary Python execution, which trivially extends to operating system command execution through modules such as os or subprocess.

Root Cause

The root cause is a trust boundary error in the template loading pipeline. The sandbox assumes that any template loaded through the precompiled loader has already passed the security checks. There is no re-verification of the precompiled output before execution, so tampered or maliciously authored templates are executed as trusted code.

Attack Vector

Exploitation requires the attacker to write template content into the directory that webpy uses for precompilation. This can occur through file upload endpoints, misconfigured shared storage, or any other primitive that allows arbitrary file writes into the templates directory. Once the malicious template is precompiled and rendered, the injected Python code executes on the server.

No verified public exploit code is available. See the GitHub CVE-2026-79310 documentation for technical details.

Detection Methods for CVE-2026-79310

Indicators of Compromise

• Unexpected .py or template files appearing in the webpy templates or precompiled template directories.
• Web server processes spawning shell interpreters such as sh, bash, or cmd.exe.
• Outbound network connections from the Python web application process to unknown external hosts.
• Modifications to template files with timestamps that do not correspond to legitimate deployments.

Detection Strategies

• Monitor file integrity of template directories and alert on writes from any process other than the deployment pipeline.
• Inspect webpy template source for suspicious constructs such as __import__, os.system, subprocess, or encoded payloads.
• Correlate application logs with process creation events to identify template renders followed by child process execution.

Monitoring Recommendations

• Enable process execution telemetry on hosts running webpy applications and baseline expected child processes of the Python interpreter.
• Log all writes to the template precompilation directory and forward them to a central SIEM for review.
• Track outbound network egress from application servers to detect command-and-control activity following exploitation.

How to Mitigate CVE-2026-79310

Immediate Actions Required

• Audit filesystem permissions on all webpy template and precompilation directories and remove write access for the web server user and any untrusted principals.
• Inventory all applications running webpy web.py 0.76 and verify whether they use the precompiled template loader.
• Review upload and file-write endpoints for paths that could resolve into template directories.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Monitor the webpy project repository for updated releases and security advisories addressing CVE-2026-79310.

Workarounds

• Store precompiled templates outside any directory that receives untrusted writes and enforce strict filesystem ACLs.
• Ship precompiled templates as part of an immutable deployment artifact rather than generating them at runtime from a mutable directory.
• Run the webpy application under a low-privilege service account with mandatory access controls that restrict execve of shell binaries.
• Disable the precompiled template loader if the application does not require it, forcing runtime sandbox validation on every render.

# Configuration example: restrict template directory permissions
chown -R root:webpy /var/www/app/templates
chmod -R 750 /var/www/app/templates
find /var/www/app/templates -type d -exec chmod g-w {} \;
find /var/www/app/templates -type f -exec chmod g-w {} \;