Zope allows attackers to modify raw image and file data

Also known as GHSA-7whr-j8vf-r4wj, PYSEC-2026-756

Published 25 y ago 2000-12-18 · modified 45 d ago 2026-09-23 · JSON

CVSS

5.0

v2.0 · NVD

CISA KEV

not known exploited

EPSS

1.5%

percentile 75%

Public exploits

none known

Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects.

Exploit prediction (EPSS)

1.54% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:P/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
pypi	`zope`	>=2.2.0, <=2.2.4	no fix listed

Classification

Weakness

CWE-284 Improper Access Control

References

frontal2.mandriva.com /security/advisories?name=MDKSA-2000:086 · vendor-advisory, x_refsource_MANDRAKE, x_transferred
zope.org /Products/Zope/Hotfix_2000-12-18/security_alert · x_refsource_CONFIRM, x_transferred
debian.org /security/2001/dsa-007 · vendor-advisory, x_refsource_DEBIAN, x_transferred
redhat.com /support/errata/RHSA-2000-135.html · vendor-advisory, x_refsource_REDHAT, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/5778 · vdb-entry, x_refsource_XF, x_transferred
osvdb.org /6283 · vdb-entry, x_refsource_OSVDB, x_transferred
distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000365 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
nvd.nist.gov /vuln/detail/CVE-2000-1212 · advisory
web.archive.org /web/20020117134418/http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000365 · web
pypi.org /project/zope · package
github.com /advisories/GHSA-7whr-j8vf-r4wj · advisory

Sources

CVE List: CVE-2000-1212
GitHub Advisory: GHSA-7whr-j8vf-r4wj
NVD: CVE-2000-1212
OSV: PYSEC-2026-756

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.