Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

Ckan remote code execution and private information access via crafted resource ids

Fix availableCritical · CVSS 9.8EPSS 1.7%

Published May 24, 2023 · updated Oct 27, 2026

What to do

  1. Upgrade to a fixed version: ckan 2.9.9, ckan 2.10.1.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIckan2,032 downloads/week

Vulnerable versions
< 2.9.9
Fixed in
2.9.9

Check your project: pip show ckan

PyPIckan2,032 downloads/week

Vulnerable versions
= 2.10.0
Fixed in
2.10.1

Check your project: pip show ckan

Sources

CWE-20 Improper Input Validation

← All critical vulnerabilities