CVE-2026-56304: picklescan - Arbitrary File Creation via logging.FileHandler Deserialization
picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting malicious pickle payloads to bypass RCE blocklists and create lock files or other filesystem artifacts, potentially causing denial of service or application disruption.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56304?
The severity of CVE-2026-56304 is classified as medium with a score of 6.5.
How do I fix CVE-2026-56304?
To fix CVE-2026-56304, update picklescan to version 1.0.1 or later.
What type of vulnerability is CVE-2026-56304?
CVE-2026-56304 is an arbitrary file creation vulnerability stemming from unsafe pickle deserialization.
Who is affected by CVE-2026-56304?
Anyone using picklescan versions prior to 1.0.1 is affected by CVE-2026-56304.
Can CVE-2026-56304 lead to remote code execution?
CVE-2026-56304 does not directly lead to remote code execution but allows attackers to create arbitrary zero-byte files.