CVE-2026-3490

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 1.0.4 UniFi OS Server (affected versions not specified)

Description picklescan fails to block pkgutil.resolve name, which allows attackers to bypass the blocklist by resolving dangerous functions through indirect REDUCE calls. This enables remote attackers to invoke blocked functions such as os.system, builtins.exec, or subprocess.call to achieve remote code execution.

UniFi OS Server contains an improper access control flaw where nginx evaluates the raw request URI for authentication but routes using the normalized URI. This allows unauthenticated attackers to reach protected endpoints and chain the issue into full root remote code execution.

Recommendations Update picklescan to version 1.0.4 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability regarding UniFi OS Server.