A vulnerability has been reported in CherryPy, which can be exploited by malicious people to disclose potentially sensitive information.

The vulnerability is caused due to an input validation error in the "staticfilter" functionality. This can be exploited to read arbitrary files on an affected system via requests containing the ".." directory traversal sequences in the URL.

The vulnerability has been reported in versions prior to 2.1.1.

Solution
Update to version 2.1.1.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Ivo van der Wijk.

Changelog
Further details available in Customer Area

Original Advisory
http://groups.google.com/group/cherrypy-announce/browse_thread/thread/92b2972f774fe6df/2f63afc9433dc306#2f63afc9433dc306

Deep Links
Links available in Customer Area