CVE-2009-5015: Turbogears TURBOGEARS2

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

The URL dispatch mechanism in TurboGears2 (aka tg2) before 2.0.2 exposes controller methods even when an @expose decoration is not used, which has unspecified impact and attack vectors.

Affected products

• Turbogears TURBOGEARS2: up to and including 2.1b2; version 1.9.7a2 only; version 1.9.7a3 only; version 1.9.7a4 only; version 1.9.7b1 only; version 1.9.7b2 only; …

Published 2010-11-06. Last modified 2026-06-16.