---
id: CVE-2011-3587
aliases:
  - GHSA-8w48-m6hx-rjw2
  - PYSEC-2026-1067
title: Zope Command Execution Vulnerability
summary: Zope Command Execution Vulnerability
severity: high
vendor: zope2
product: zope2
ecosystem: pip
affected:
  - 'zope2 >= 2.12.0, < 2.12.20'
  - 'zope2 >= 2.13.0, < 2.13.10'
patched:
  - zope2 2.12.20
  - zope2 2.13.10
published: '2022-05-17'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8w48-m6hx-rjw2'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2011-3587'
  - url: >-
      https://github.com/zopefoundation/Zope/commit/491a583d8c6622b80c75917e5017c4bb4b15e477
  - url: >-
      https://github.com/zopefoundation/Zope/commit/6bb2fb3c04a76b00bec9bd7c069733e06fa6ebe9
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=742297'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/products-plonehotfix20110928/PYSEC-2011-26.yaml
  - url: 'https://github.com/zopefoundation/Zope'
  - url: >-
      https://web.archive.org/web/20111013043934/http://zope2.zope.org/news/security-vulnerability-announcement-cve-2011-3587
  - url: 'http://plone.org/products/plone-hotfix/releases/20110928'
  - url: >-
      http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip
  - url: 'http://plone.org/products/plone/security/advisories/20110928'
  - url: 'http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0'
  - url: >-
      http://zope2.zope.org/news/security-vulnerability-announcement-cve-2011-3587
tags:
  - osv
  - pip
  - exploit-available
epss: 0.78079
epssPercentile: 0.99566
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:47.557Z'
exploits:
  exploitdb: true
  metasploit:
    - exploit/multi/http/plone_popen2
  checkedAt: '2026-09-21T15:24:36.253Z'
---

## Overview

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the `p_` class in `OFS/misc_.py` and the use of Python modules.

## Affected packages

- `zope2 >= 2.12.0, < 2.12.20`
- `zope2 >= 2.13.0, < 2.13.10`

## Remediation

Upgrade to a patched release:

- `zope2 2.12.20`
- `zope2 2.13.10`