Vulnerability Description
picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen. Attackers can bypass RCE-focused blocklists to exfiltrate sensitive data like /etc/passwd to external servers.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9726-w42j-3qjr
- https://www.vulncheck.com/advisories/picklescan-arbitrary-file-read-via-unsafe-p
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9726-w42j-3qjr
FAQ
What is CVE-2026-53872?
CVE-2026-53872 is a vulnerability with a CVSS score of 7.5 (HIGH). picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen. Att...
How severe is CVE-2026-53872?
CVE-2026-53872 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-53872?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.