CVE-2026-56304
published 2026-06-20CVE-2026-56304: picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via…
PriorityP338medium6.5CVSS 3.1
AVNACLPRNUINSUCNILAL
EPSS
0.29%
20.5th percentile
picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting malicious pickle payloads to bypass RCE blocklists and create lock files or other filesystem artifacts, potentially causing denial of service or application disruption.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mmaitre314 | picklescan | < 1.0.1 | 1.0.1 |
| picklescan | picklescan | < 1.0.1 | 1.0.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
picklescan up to 1.0.0 logging.FileHandler deserialization (GHSA-m7j5-r2p5-c39r / EUVD-2026-38123)
vuldb·2026-06-20·CVSS 6.5
CVE-2026-56304 [MEDIUM] picklescan up to 1.0.0 logging.FileHandler deserialization (GHSA-m7j5-r2p5-c39r / EUVD-2026-38123)
A vulnerability marked as critical has been reported in picklescan up to 1.0.0. This vulnerability affects the function logging.FileHandler. The manipulation leads to deserialization.
This vulnerability is documented as CVE-2026-56304. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation.
ghsa_unreviewed·2026-06-20
CVE-2026-56304 [MEDIUM] CWE-502 picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation.
picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting malicious pickle payloads to bypass RCE blocklists and create lock files or other filesystem artifacts, potentially causing denial of service or application disruption.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-20
Published