CVE-2016-3953: Critical severity Web2py Web2py vulnerability
Last updated 25 August 2025
Other sources
The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the session.connect function.
The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the session.connect function.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-3953?
CVE-2016-3953 is a vulnerability in the sample web application in web2py before version 2.14.2 that allows remote attackers to execute arbitrary code.
How can remote attackers exploit CVE-2016-3953?
Remote attackers can exploit CVE-2016-3953 by leveraging a hardcoded encryption key when calling the session.connect function in web2py.
What is the severity of CVE-2016-3953?
CVE-2016-3953 has a severity rating of 9.8 (critical).
How do I fix CVE-2016-3953 on web2py?
To fix CVE-2016-3953 on web2py, update to version 2.14.2 or newer.
Are there any references for CVE-2016-3953?
Yes, you can find more information about CVE-2016-3953 at the following references: [1] https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/ [2] https://github.com/web2py/web2py/blob/R-2.14.1/applications/examples/models/session.py [3] https://usn.ubuntu.com/4030-1/