---
id: CVE-2016-4808
aliases:
  - GHSA-gp69-xcm6-ffqj
  - PYSEC-2026-1061
title: Web2py Cross-Site Request Forgery vulnerability
summary: Web2py Cross-Site Request Forgery vulnerability
severity: medium
cvss: 4.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H'
vendor: web2py
product: web2py
ecosystem: pip
affected:
  - web2py < 2.14.6
patched:
  - web2py 2.14.6
published: '2022-05-17'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-gp69-xcm6-ffqj'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2016-4808'
  - url: 'https://github.com/web2py/web2py'
  - url: 'https://www.exploit-db.com/exploits/39821'
  - url: >-
      http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html
tags:
  - osv
  - pip
  - exploit-available
epss: 0.01756
epssPercentile: 0.76947
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:49.751Z'
exploits:
  exploitdb: true
  checkedAt: '2026-09-23T07:13:21.386Z'
---

## Overview

Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged-in administrator into performing unwanted actions i.e An attacker can trick a victim into disable the installed application just by visiting a URL.

## Affected packages

- `web2py < 2.14.6`

## Remediation

Upgrade to a patched release:

- `web2py 2.14.6`