Remote Code Execution Vulnerability in EPyT-Flow Python Package
CVE-2026-25632
Key Information:
- Vendor
Waterfutures
- Status
- Vendor
- CVE Published:
- 6 February 2026
Badges
What is CVE-2026-25632?
The EPyT-Flow Python package, which facilitates the generation of hydraulic and water quality scenario data for water distribution networks, contains a vulnerability that enables remote code execution. Prior to version 0.16.1, the package's REST API incorrectly processes attacker-manipulated JSON request bodies using a custom deserializer. This deserializer, which dynamically imports specified modules or classes based on user input, can lead to instances where malicious code is executed on the server, including commands via subprocess.Popen. Affected users are encouraged to upgrade to version 0.16.1, where this vulnerability has been addressed.
Affected Version(s)
EPyT-Flow < 0.16.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.