Insecure Deserialization in Treeio Product by Treeio
CVE-2026-124318

8.6HIGH

Key Information:

Vendor

Treeio

Status
Treeio
Vendor
CVE Published:
7 November 2026

What is CVE-2026-124318?

Treeio versions up to 2.0 are affected by an insecure deserialization vulnerability that enables staff users to execute arbitrary code via crafted base64 pickle payloads. This vulnerability arises from the methods UpdateRecord.get_format_strings and ModuleSetting.loads, which allow attackers to inject unverified pickle data through the Django admin interface. Consequently, when news feeds are rendered, the stored payload can execute Python code under the privileges of the web server user, posing a significant security risk.

Affected Version(s)

treeio 0 <= 2.0

References

https://github.com/treeio/treeio/issues/165
issue-tracking
https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc...
technical-description
https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc...
technical-description

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

MJ DHURGESH
.