CVE-2026-53872: picklescan - Arbitrary File Read via Unsafe Pickle Deserialization
picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen. Attackers can bypass RCE-focused blocklists to exfiltrate sensitive data like /etc/passwd to external servers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
picklescanto a version that resolves this vulnerability.Fixed in 0.0.35
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53872?
The severity of CVE-2026-53872 is rated high with a score of 8.7.
How do I fix CVE-2026-53872?
To mitigate CVE-2026-53872, update picklescan to version 0.0.35 or later.
What is the impact of CVE-2026-53872?
CVE-2026-53872 allows unauthenticated attackers to read arbitrary server files, which could expose sensitive data.
Who is affected by CVE-2026-53872?
Any user of picklescan versions prior to 0.0.35 is vulnerable to CVE-2026-53872.
What type of vulnerability is CVE-2026-53872?
CVE-2026-53872 is classified as a path traversal vulnerability due to unsafe pickle deserialization.