{"id":"CVE-2014-4650","url":"https://www.cyber-defence.io/tools/cve/CVE-2014-4650","generatedAt":"2026-11-05T02:15:20.679Z","title":"The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended…","description":"The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.","published":"2020-02-20T17:15:12.000Z","lastModified":"2026-06-17T00:10:24.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-22"],"affected":["python/python","redhat/software collections","redhat/enterprise linux"],"epss":{"score":0.23907,"percentile":0.97837,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2014-06-27","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":33894,"kind":"exploit","title":"Python CGIHTTPServer - Encoded Directory Traversal","url":"https://www.exploit-db.com/exploits/33894","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/33894.txt","file":"exploits/multiple/webapps/33894.txt","published":"2014-06-27","added":"2014-06-27","updated":"2014-06-27","author":"RedTeam Pentesting","type":"webapps","platform":"multiple","port":null,"verified":true,"codes":["CVE-2014-4650","OSVDB-108369"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.redteam-pentesting.de/advisories/rt-sa-2014-008"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 23.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://bugs.python.org/issue21766","tags":["Exploit","Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://openwall.com/lists/oss-security/2014/06/26/3","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://access.redhat.com/security/cve/cve-2014-4650","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://bugs.python.org/issue21766","tags":["Exploit","Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://openwall.com/lists/oss-security/2014/06/26/3","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/security/cve/cve-2014-4650","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-4650","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}