CVE-2026-77401: Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions
Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In both ImplPython.py and cAccessControl.c, Python formatting can recursively access attributes and subscriptions using unrestricted getattr and getitem behavior instead of the policy-restricted getattr and getitem operations. A controlled format string can therefore disclose objects reachable from values available to the formatting operation. This issue is fixed in version 7.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zope AccessControlto a version that resolves this vulnerability.Fixed in 7.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using Zope AccessControl before version 7.4 are affected only if untrusted users can create and execute AccessControl-controlled Python code. The vulnerable behavior is triggered when str.format or str.format_map is reached through a str subclass.
What does an attacker need to exploit this issue?
An attacker needs the ability to supply or control a format string in AccessControl-controlled Python code and have values available to the formatting operation. They can use recursive attribute and subscription access to disclose reachable objects.
What should be done to remediate the issue?
Upgrade Zope AccessControl to version 7.4, which fixes the issue. If upgrading cannot happen immediately, restrict untrusted users from creating or executing AccessControl-controlled Python code and prevent their control of formatting operations involving str subclasses.
How can I assess whether a vulnerable application is at risk?
Review whether the application uses an AccessControl version earlier than 7.4 and permits untrusted users to create and execute controlled Python code. Also identify uses of str.format or str.format_map through str subclasses where user-controlled format strings can access values containing sensitive or otherwise reachable objects.