CVE-2026-77401— Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions
Quick assessment
Affected
zopefoundation AccessControl
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Zope AccessControl 为在 Zope 中使用提供了一种通用的安全框架。在 7.4 版本之前，允许不受信任的用户创建并执行由 AccessControl 控制的 Python 代码的应用程序，在通过 str 子类访问时，未能安全地保护 和 方法。在 和 中，Python 格式化操作可通过无限制的 和 行为递归地访问属性和订阅，而不是使用策略受限的 和 操作。因此，受控的格式化字符串可能会泄露可通过格式化操作访问到的对象。该问题已在 7.4 版本中修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77401
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions
Source: CVE Program / CVE List V5
Vulnerability Description
Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.format_map when those methods are reached through a str subclass. In both ImplPython.py and cAccessControl.c, Python formatting can recursively access attributes and subscriptions using unrestricted getattr and getitem behavior instead of the policy-restricted getattr and getitem operations. A controlled format string can therefore disclose objects reachable from values available to the formatting operation. This issue is fixed in version 7.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zopefoundation | AccessControl | < 7.4 | - |
|
II. Public POCs for CVE-2026-77401
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77401
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-77401 (1)
Vendor Advisories for CVE-2026-77401 (1)
Vendor Pages for CVE-2026-77401 (1)
-
🔗 Release 7.4 · zopefoundation/AccessControl · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: zopefoundation
-
CVE-2026-76825
RestrictedPython: Sandbox escape via string.Formatter field -
CVE-2026-55830
RestrictedPython guard hooks can be shadowed via positional- -
CVE-2025-22153
try/except* clauses could allow bypass RestrictedPython via -
CVE-2024-51734
User data deletion by anoynmous users in Zope -
CVE-2024-47532
RestrictedPython information leakage via `AttributeError.obj
Same weakness: CWE-693
-
CVE-2026-20331
Cisco Secure Adaptive Security Appliance Software, Secure Fi -
CVE-2026-91949
FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass -
CVE-2026-57137
PraisonAI AgentLoop onToolCall approval runs after tool exec -
CVE-2026-47424
OpenAM Authenticated RCE via Groovy Sandbox Escape -
CVE-2026-57120
PraisonAI: execute_code sandbox bypass: str.format C-level a
V. Comments for CVE-2026-77401
No comments yet