Path traversal in Python - CVE-2014-4650

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

Affected software

How to mitigate CVE-2014-4650

Links to Public Exploits and PoC-codes

• Exploit #11445 - Python CGIHTTPServer - Encoded Directory Traversal (June 3, 2025)

External References

• http://bugs.python.org/issue21766
• http://openwall.com/lists/oss-security/2014/06/26/3
• https://access.redhat.com/security/cve/cve-2014-4650

Related Security Bulletins

• Path traversal in Python
• Fedora 21 update for python3