CVE-2008-0252: Cherrypy

High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.

Affected products

• Cherrypy Cherrypy: up to and including 2.1.0; up to and including 3.0.2

Published 2008-01-12. Last modified 2026-06-16.