CVE-2021-32807

CVE-2021-32807 is a high-severity vulnerability affecting Zope AccessControl versions 4 and 5 on Python 3, allowing remote code execution. It arises from an insecure default configuration where the 'string' module's 'Formatter' class can be overridden within Zope's 'Script (Python)' objects, granting access to unsafe Python libraries. Exploitation requires an attacker to have Zope Manager-level privileges, typically gained through an unusual configuration allowing untrusted users to edit scripts via the web. While the CVSS score is 7.2 (High), there is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.