The vulnerability allows an attacker to manipulate file paths passed to the read_file() and write_file() functions in web2py's admin controllers, enabling the traversal of directory boundaries. An attacker can read arbitrary files from the server and, due to the write_file() endpoint, can place or overwrite files in sensitive locations. This can lead to exposure of confidential data and facilitate further compromise of the system if executable or configuration files are tampered with.

Any deployment of web2py 3.2.2-stable built from commit a7330a2bf21219fa77860b6665de927dd4f98e6d or equivalent that retains the vulnerable read_file/write_file implementation is affected. No specific supported vendor or product list is available because the vulnerability exists in the open‑source framework itself.

The directory traversal weakness (CWE‑22) is directly exploitable through crafted HTTP requests to the administrative web services. The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1 % suggests low current exploitation probability; however, the potential impact remains significant if exposed to an untrusted network. Since the vulnerability is not listed in the CISA KEV catalog and no official fix from a CNA is provided, administrators should proactively upgrade or apply a manual patch to mitigate the risk.