p PatchFirst

CVE-2026-56304

CVE-2026-56304 · picklescan - Arbitrary File Creation via logging.FileHandler Deserialization

This page contains facts from public vulnerability sources. Check the original advisory before updating.

picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting malicious pickle payloads to bypass RCE blocklists and create lock files or other filesystem artifacts, potentially causing denial of service or application disruption.

CVSS 6.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • picklescan

    Versions
    • ≥ 0, < 1.0.1: Affected (semver)
    • 1.0.1: Not affected (semver)

    Update to 1.0.1

  • picklescan PyPI

    Versions
    • 0.0.1
    • 0.0.10
    • 0.0.11
    • 0.0.12
    • 0.0.13
    • 0.0.14
    • 0.0.15
    • 0.0.16
    • 0.0.17
    • 0.0.18
    • 0.0.19
    • 0.0.2
    • 0.0.20
    • 0.0.21
    • 0.0.22
    • 0.0.23
    • 0.0.24
    • 0.0.25
    • 0.0.26
    • 0.0.27
    • 0.0.28
    • 0.0.29
    • 0.0.3
    • 0.0.30
    • 0.0.31
    • 0.0.32
    • 0.0.33
    • 0.0.34
    • 0.0.35
    • 0.0.4
    • 0.0.5
    • 0.0.6
    • 0.0.7
    • 0.0.8
    • 0.0.9
    • 1.0.0
    Affected ranges
    • ECOSYSTEM: < 1.0.1

    Update to 1.0.1

Original sources

Check your server →