GHSA-vx77-5pf4-c9wr · Severity: high · Ecosystem: pip — CherryPy Directory traversal vulnerability
Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors.
Conclusion & alert: CVE-2006-0847 is rated Moderate Risk (50.1/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 2.33%). Core evidence: EPSS rose +1.69% over the last day, indicating growing attacker interest. Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.64% | 2.33% | +1.69% |
| 2 | 2025-12-28 | 0.85% | 0.64% | -0.21% |
| 3 | 2025-12-27 | — | 0.85% | — |
Full EPSS history (13 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
GHSA-vx77-5pf4-c9wr · Severity: high · Ecosystem: pip — CherryPy Directory traversal vulnerability
| vendor | priority | summary | link |
|---|---|---|---|
gentoo
|
low | CVE-2006-0847: 1 GLSA(s) (200605-16), 1 atom(s) (dev-python/cherrypy); latest impact low. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2006-0847 |
ubuntu
|
medium | CVE-2006-0847 medium priority: Ubuntu including 2 source packages (cherrypy3, python-cherrypy), 18 status rows across 9 suites (dapper, edgy, feisty, gutsy, hardy, intrepid, jaunty, karmic, upstream): released 12, DNE 3, needs-triage 2, ignored 1. | https://ubuntu.com/security/CVE-2006-0847 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| cherrypy | cherrypy | 0.1 | cpe:2.3:a:cherrypy:cherrypy:0.1:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.2 | cpe:2.3:a:cherrypy:cherrypy:0.2:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.3 | cpe:2.3:a:cherrypy:cherrypy:0.3:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.4 | cpe:2.3:a:cherrypy:cherrypy:0.4:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.5 | cpe:2.3:a:cherrypy:cherrypy:0.5:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.6 | cpe:2.3:a:cherrypy:cherrypy:0.6:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.7 | cpe:2.3:a:cherrypy:cherrypy:0.7:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.8 | cpe:2.3:a:cherrypy:cherrypy:0.8:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.8_beta | cpe:2.3:a:cherrypy:cherrypy:0.8_beta:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.9 | cpe:2.3:a:cherrypy:cherrypy:0.9:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.9_beta | cpe:2.3:a:cherrypy:cherrypy:0.9_beta:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.9_gamma | cpe:2.3:a:cherrypy:cherrypy:0.9_gamma:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.9_rc1 | cpe:2.3:a:cherrypy:cherrypy:0.9_rc1:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.10 | cpe:2.3:a:cherrypy:cherrypy:0.10:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.10_beta | cpe:2.3:a:cherrypy:cherrypy:0.10_beta:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 0.10_rc1 | cpe:2.3:a:cherrypy:cherrypy:0.10_rc1:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 2.0.0 | cpe:2.3:a:cherrypy:cherrypy:2.0.0:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 2.0.0a1 | cpe:2.3:a:cherrypy:cherrypy:2.0.0a1:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 2.1.0 | cpe:2.3:a:cherrypy:cherrypy:2.1.0:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 2.1.0_beta | cpe:2.3:a:cherrypy:cherrypy:2.1.0_beta:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 2.1.0_rc1 | cpe:2.3:a:cherrypy:cherrypy:2.1.0_rc1:*:*:*:*:*:*:* |
| cherrypy | cherrypy | 2.1.0_rc2 | cpe:2.3:a:cherrypy:cherrypy:2.1.0_rc2:*:*:*:*:*:*:* |