PT-2026-139494

CVE-2026-124318

·

Published

2026-11-07

·

Updated

2026-11-07

Description by

CVSS 3.1
7.2
High
MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get format strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format strings field through the Django admin, executing Python code as the web server user when news feeds render.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-502: Deserialization of Untrusted Data
Related identifiers
CVE-2026-124318
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com