Remote Code Execution Vulnerability in RELATE LMS by Inducer

CVE-2026-47161

What is CVE-2026-47161?

The RELATE LMS, a web-based courseware package, was previously configured to accept and deserialize untrusted 'pickle' data within its Celery workers. This flaw allows attackers with access to the message broker to execute arbitrary commands on the host server. Coupled with insufficient network isolation in the code execution sandbox, this vulnerability permits authenticated users to achieve full Remote Code Execution (RCE) on the server. The issue has been addressed in a subsequent code commit, which mitigates this significant security risk.

References