CVE-2014-3137

CVE-2014-3137 is a content type bypass vulnerability affecting Bottle framework versions 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6. This flaw allows remote attackers to circumvent access restrictions by appending an unaccepted Content-Type after a semicolon to an accepted one, potentially leading to arbitrary code execution as demonstrated in YouCompleteMe. With a CVSS score of 6.8 (medium severity), it has a network attack vector, medium attack complexity, and can result in partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, publicly available exploit code in Metasploit or ExploitDB, nor significant community discussion or media coverage.