pypi package report

Is cherrypy safe?

2 known vulnerabilities, worst severity HIGH.

// reach

15 direct dependencies

3 carry known advisories, worst HIGH

14 packages depend on it

an advisory here reaches each of them

  • girder
  • oic
Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage

No published models are known to use this package.

cvss
7.5
high

CVSS v3.1 base score out of 10

epss
2.7%
medium

chance of exploitation in 30 days, 86th percentile of all CVEs

xyz score
4.2
medium

CyberXYZ composite out of 10

fig. 01 — GHSA-76x8-gg39-5jjg, the advisory selected below

// 2 advisories

GHSA-76x8-gg39-5jjg

HIGHGitHub ratingCVE-2008-0252

Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Checked 2026-11-06 at 22:18 UTC. The most recent advisory here was published 2022-05-01. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.