CVE-2026-79318: web2py Path Traversal Vulnerability

CVE-2026-79318 Overview

CVE-2026-79318 is a directory traversal vulnerability in web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d). The flaw resides in the read_file() and write_file() functions inside applications/admin/controllers/webservices.py. An authenticated attacker with high privileges can supply crafted file paths to read or overwrite arbitrary files on the server. The issue is classified as [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated attackers can read sensitive files and overwrite application code, leading to configuration disclosure and potential remote code execution on the web2py host.

Affected Products

web2py 3.2.2-stable
Commit a7330a2bf21219fa77860b6665de927dd4f98e6d
web2py admin application (applications/admin/controllers/webservices.py)

Discovery Timeline

2026-09-21 - CVE-2026-79318 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-79318

Vulnerability Analysis

The vulnerability affects the web2py administrative web services module. Both read_file() and write_file() accept file path parameters without validating that the resolved path stays within the intended application directory. An authenticated administrator can submit path traversal sequences such as ../ to escape the sandbox. This grants access to arbitrary files readable or writable by the web2py process account.

Because the affected endpoints belong to the admin interface, exploitation requires valid administrator credentials. However, write access to arbitrary paths enables an attacker to overwrite Python controllers or model files. Overwriting server-side code typically leads to remote code execution in the web2py runtime context.

Root Cause

The root cause is missing canonicalization and containment checks on user-supplied file path arguments inside webservices.py. Neither read_file() nor write_file() normalizes the path and validates that it resolves under the expected application root. Directory traversal sequences are passed unchanged to the underlying file I/O calls.

Attack Vector

The attack vector is network based over HTTP or HTTPS to the web2py admin interface. An authenticated user invokes the affected webservice endpoints with a path parameter containing traversal sequences. The server processes the request, resolves the path outside the intended directory, and performs the requested read or write. See the CVE-2026-79318 technical write-up for reproduction details.

// No verified proof-of-concept code is published in the enriched data.
// Refer to the linked technical write-up for reproduction details.

Detection Methods for CVE-2026-79318

Indicators of Compromise

HTTP requests to /admin/webservices/read_file or /admin/webservices/write_file containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths.
Unexpected modifications to files under applications/*/controllers/, applications/*/models/, or web2py configuration files.
Access to sensitive host files such as /etc/passwd, /etc/shadow, or private key material by the web2py process.
Admin session activity from unusual source addresses immediately preceding file system anomalies.

Detection Strategies

Inspect web server and application logs for admin webservice requests with path traversal patterns in query strings or POST bodies.
Deploy file integrity monitoring on the web2py applications/ directory to alert on unauthorized changes.
Correlate authenticated admin sessions with subsequent file system reads or writes outside the application root.

Monitoring Recommendations

Enable verbose logging on the web2py admin application and forward logs to a centralized analytics platform.
Alert on any invocation of read_file or write_file webservice endpoints from non-administrative source networks.
Baseline normal admin activity and flag requests that reference paths outside the expected application tree.

How to Mitigate CVE-2026-79318

Immediate Actions Required

Restrict network access to the web2py admin interface to trusted management networks or VPN endpoints only.
Rotate all web2py administrator credentials and enforce strong, unique passwords.
Audit applications/ directories for unauthorized file modifications and restore from known-good backups if tampering is found.
Disable the admin application on production instances that do not require it.

Patch Information

No vendor patch is referenced in the enriched CVE data. Monitor the web2py GitHub repository for updates addressing the read_file() and write_file() functions in applications/admin/controllers/webservices.py.

Workarounds

Remove or comment out the read_file and write_file handlers in applications/admin/controllers/webservices.py until a fix is released.
Front the admin interface with a reverse proxy that blocks requests containing ../, ..\, or encoded traversal sequences.
Run the web2py process under a low-privilege account with file system permissions scoped to the application directory.

bash

# Example nginx rule to block traversal patterns targeting the admin webservices
location /admin/webservices/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://web2py_backend;
}