---
id: CVE-2016-3954
aliases:
  - GHSA-jr83-vr4j-mp6p
  - PYSEC-2026-1062
title: web2py exposure of sensitive information
summary: web2py exposure of sensitive information
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
vendor: web2py
product: web2py
ecosystem: pip
affected:
  - web2py < 2.14.2
patched:
  - web2py 2.14.2
published: '2022-05-14'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-jr83-vr4j-mp6p'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2016-3954'
  - url: >-
      https://github.com/web2py/web2py/commit/0820926b500a321060ef6a76ce89fd35a252f8b0
  - url: >-
      https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957
  - url: 'https://github.com/web2py/web2py'
  - url: 'https://usn.ubuntu.com/4030-1'
tags:
  - osv
  - pip
epss: 0.01462
epssPercentile: 0.72043
ingestedAt: '2026-07-08T18:25:50.875Z'
---

## Overview

web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status.  NOTE: this issue can be leveraged by remote attackers to execute arbitrary code using CVE-2016-3957.

## Affected packages

- `web2py < 2.14.2`

## Remediation

Upgrade to a patched release:

- `web2py 2.14.2`