description: An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.
problem types: OS command injection
affected:
{
vendor: web2py
product: web2py
versions:
version: 2.24.1 and earlier, status: affected
}