CVE-2006-3458

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-07-07 · updated 2026-06-16

Description

Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.

Affected products

zopefoundation Zope: 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.7.5 (+15)

References

http://mail.zope.org/pipermail/zope-announce/2006-July/001984.html
http://secunia.com/advisories/20988
http://secunia.com/advisories/21025
http://secunia.com/advisories/21130
http://secunia.com/advisories/21459
http://www.debian.org/security/2006/dsa-1113
http://www.novell.com/linux/security/advisories/2006_19_sr.html
http://www.securityfocus.com/bid/18856
http://www.vupen.com/english/advisories/2006/2681
http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-20060705/README.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/27636
https://usn.ubuntu.com/317-1/

Get alerted when CVE-2006-3458 or the next vulnerability affects your stack