CVE-2016-3957: Critical severity Web2py Web2py vulnerability
Last updated 25 August 2025
Other sources
The secureload function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to execute arbitrary code by leveraging knowledge of encryptionkey.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-3957?
CVE-2016-3957 is a vulnerability in web2py before 2.14.2 that allows remote attackers to execute arbitrary code by deserializing session information stored in cookies.
How does the secure_load function in web2py before 2.14.2 contribute to CVE-2016-3957?
The secure_load function in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which can be exploited by attackers to execute arbitrary code.
What is the severity level of CVE-2016-3957?
CVE-2016-3957 has a severity level of 9.8 (critical).
Which versions of web2py are affected by CVE-2016-3957?
Versions before 2.14.2 of web2py are affected by CVE-2016-3957.
How can I mitigate the vulnerability CVE-2016-3957 in web2py?
To mitigate CVE-2016-3957, it is recommended to update web2py to version 2.14.2 or later.