CVE-2016-3952: WEB2PY

High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days.

web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify. NOTE: this issue can be leveraged by remote attackers to gain administrative access.

Affected products

• WEB2PY WEB2PY: before 2.14.1 (fixed in 2.14.1)

Published 2018-02-06. Last modified 2026-06-17.