---
id: CVE-2012-0878
aliases:
  - GHSA-27px-qpmj-qg38
  - PYSEC-2012-15
  - PYSEC-2026-2859
title: Paste Script has improper group memberships permissions
summary: Paste Script has improper group memberships permissions
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
vendor: pastescript
product: pastescript
ecosystem: pip
affected:
  - pastescript < 2.0.1
  - paste < 1.7.5.1
patched:
  - pastescript 2.0.1
  - paste 1.7.5.1
published: '2022-05-17'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-27px-qpmj-qg38'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2012-0878'
  - url: >-
      https://github.com/cdent/pastescript/commit/b5f36f2995e1ae117cc53d2bd458d7fb33e4cabe
  - url: 'https://bitbucket.org/ianb/pastescript/changeset/a19e462769b4'
  - url: >-
      https://bitbucket.org/ianb/pastescript/pull-request/3/fix-group-permissions-for-pastescriptserve
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=796790'
  - url: 'https://github.com/pasteorg/pastescript'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/paste/PYSEC-2012-15.yaml
  - url: >-
      https://web.archive.org/web/20140723093519/http://secunia.com/advisories/50410
  - url: >-
      https://web.archive.org/web/20140803132259/http://secunia.com/advisories/48812
  - url: >-
      http://groups.google.com/group/paste-users/browse_thread/thread/2aa651ba331c2471
  - url: 'http://rhn.redhat.com/errata/RHSA-2012-1206.html'
  - url: 'http://www.openwall.com/lists/oss-security/2012/02/23/1'
  - url: 'http://www.openwall.com/lists/oss-security/2012/02/23/4'
tags:
  - osv
  - pip
epss: 0.04027
epssPercentile: 0.90165
ingestedAt: '2026-07-13T18:57:51.230Z'
---

## Overview

Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.

## Affected packages

- `pastescript < 2.0.1`
- `paste < 1.7.5.1`

## Remediation

Upgrade to a patched release:

- `pastescript 2.0.1`
- `paste 1.7.5.1`