Unsafe Pickle Deserialization in Picklescan Affects File Integrity
CVE-2026-56304

6.9MEDIUM

Key Information:

Vendor

Picklescan

Status
Picklescan
Vendor
CVE Published:
20 June 2026

What is CVE-2026-56304?

Picklescan prior to version 1.0.1 is susceptible to an unsafe pickle deserialization flaw that enables unauthenticated attackers to create arbitrary zero-byte files. This vulnerability arises from the improper handling of the logging.FileHandler class during instantiation. By sending carefully crafted malicious pickle payloads, attackers can bypass existing remote code execution blocklists. This exploitation could lead to the creation of unauthorized lock files or other filesystem artifacts, posing significant risks including service interruptions and application instability.

Affected Version(s)

picklescan 0 < 1.0.1

picklescan 1.0.1

References

https://github.com/mmaitre314/picklescan/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/picklescan-arbitrary...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ez-lbz
.