{"id":"CVE-2026-124318","kind":"vulnerability","aliases":["CVE-2026-124318"],"related":[],"title":"Treeio: staff users can run Python code through stored pickle data","description":"Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render.","summary":"Treeio, a Django-based web application, deserializes pickle data stored in UpdateRecord format_strings and ModuleSetting values without verification. A staff user who stores a crafted base64 pickle payload through the Django admin can execute Python code as the web server user when news feeds render.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"treeio","fixed":[],"affected":"<= 2.0","ecosystem":"pip"}],"ecosystems":[],"tags":["django","package","self-hosted","treeio"],"not_affected_if":["admin-not-exposed","newer-than-2.0","no-staff-write-access"],"how_to_check":"- Run `pip show treeio` or check the installed version; 2.0 and earlier are affected, and no fixed version exists.\n- Look for pickle.loads in treeio/core/models.py (UpdateRecord.get_format_strings, ModuleSetting.loads; the issue also names ConfigSetting.loads).\n- Review who has Django admin/staff access to UpdateRecord, ModuleSetting and ConfigSetting, and audit those rows for unexpected base64 values.","fix":"No fixed release. The maintainers' issue #165 is open (as of 2026-11-07) and the repository's last push was 2022-04-29. Workaround: restrict staff/admin write access to UpdateRecord, ModuleSetting and ConfigSetting, or patch the code to replace pickle with json.","status":"open","published_at":"2026-11-07T15:17:16+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","triaged_at":"2026-11-07T15:48:10+00:00","updated_at":"2026-11-07T15:49:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T15:48:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Treeio: staff users can run Python code through stored pickle data","impact":"high","summary":"Treeio, a Django-based web application, deserializes pickle data stored in UpdateRecord format_strings and ModuleSetting values without verification. A staff user who stores a crafted base64 pickle payload through the Django admin can execute Python code as the web server user when news feeds render.","audience":"businesses","category":"package","nicknames":[],"who_cares":["treeio","django","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Code runs as the web server user, exposing server secrets and data","analyst_note":"Confirm the fixed Treeio version and whether a patch or setting change exists; check the VulnCheck advisory linked in the sources.","how_to_check":"- Check whether the installed Treeio version is 2.0 or earlier, for example by reading the project's version file or `pip show treeio`\n- Check whether staff users can edit UpdateRecord entries in the Django admin\n- unknown whether the sources name a specific configuration that changes exposure","plain_action":"","needs_analyst":true,"not_affected_if":["no-staff-write-access","newer-than-2.0"],"who_is_affected":"Teams running Treeio through 2.0 where staff accounts can reach the Django admin or other ways to write UpdateRecord or ModuleSetting data. The exposure comes from storing and then rendering pickle data, so instances without staff write access to those fields are less exposed. Sources do not describe a fixed release.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4276,"output_tokens":584,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed Treeio version and whether a patch or setting change exists; check the VulnCheck advisory linked in the sources.","search":"'-124318':14A,17A '-2026':13A,16A '2.0':74C 'admin':58B,114C 'allow':87C 'applic':31B 'attack':97C 'base':29B 'base64':52B,102C 'code':7A,62B,92C,117C 'contain':75C 'craft':51B,101C 'cve':12A,15A 'data':11A,34B,96C 'deseri':32B,78C 'django':19B,28B,57B,113C 'django-bas':27B 'execut':60B,91C,115C 'feed':70B,125C 'field':110C 'format':38B,82C,108C 'host':23B 'insecur':77C 'moduleset':41B 'modulesetting.loads':85C 'news':69B,124C 'packag':20B 'payload':54B,104C 'pickl':10A,33B,53B,95C,103C 'python':6A,61B,116C 'render':71B,126C 'run':5A 'self':22B 'self-host':21B 'server':66B,121C 'staff':2A,46B,88C 'store':9A,35B,49B,99C 'string':39B,83C,109C 'treeio':1A,18A,24B,25B,72C 'unverifi':94C 'updaterecord':37B,107C 'updaterecord.get':81C 'user':3A,47B,67B,89C,122C 'valu':42B 'verif':44B 'via':93C 'vulner':79C 'web':30B,65B,120C 'without':43B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Treeio (Django business-management app) installs at version 2.0 or earlier. Exploitation needs a staff/admin account that can edit UpdateRecord or ModuleSetting values in the Django admin; the stored pickle runs as the web server user when the data is read, for example when news feeds render. Installs where only fully trusted people have admin access are much less exposed; there is no fix, so treat the project as unmaintained.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["treeio"],"ptokens":["treeio"],"labels":["django","high","package","selfhosted","treeio"],"campaign_type":null,"search_a":"'-124318':14A,17A '-2026':13A,16A 'code':7A 'cve':12A,15A 'data':11A 'pickl':10A 'python':6A 'run':5A 'staff':2A 'store':9A 'treeio':1A,18A 'user':3A","search_b":"'admin':58B 'applic':31B 'base':29B 'base64':52B 'code':62B 'craft':51B 'data':34B 'deseri':32B 'django':19B,28B,57B 'django-bas':27B 'execut':60B 'feed':70B 'format':38B 'host':23B 'moduleset':41B 'news':69B 'packag':20B 'payload':54B 'pickl':33B,53B 'python':61B 'render':71B 'self':22B 'self-host':21B 'server':66B 'staff':46B 'store':35B,49B 'string':39B 'treeio':24B,25B 'updaterecord':37B 'user':47B,67B 'valu':42B 'verif':44B 'web':30B,65B 'without':43B","search_c":"'2.0':74C 'admin':114C 'allow':87C 'attack':97C 'base64':102C 'code':92C,117C 'contain':75C 'craft':101C 'data':96C 'deseri':78C 'django':113C 'execut':91C,115C 'feed':125C 'field':110C 'format':82C,108C 'insecur':77C 'modulesetting.loads':85C 'news':124C 'payload':104C 'pickl':95C,103C 'python':116C 'render':126C 'server':121C 'staff':88C 'store':99C 'string':83C,109C 'treeio':72C 'unverifi':94C 'updaterecord':107C 'updaterecord.get':81C 'user':89C,122C 'via':93C 'vulner':79C 'web':120C","first_public_at":"2026-11-07T15:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124318","severity":null,"published_at":"2026-11-07T15:17:16+00:00","modified_at":"2026-11-07T15:17:16+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","fetched_at":"2026-11-07T15:47:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124318:2133","url":"https://github.com/treeio/treeio/issues/165","severity":null,"published_at":"2026-11-07T15:49:12+00:00","modified_at":"2026-11-07T15:49:12+00:00","first_seen_at":"2026-11-07T15:49:12+00:00","fetched_at":"2026-11-07T15:49:12+00:00","note":"VulnCheck advisory and upstream issue #165 (open, filed 2026-11-06) read. No fix or patch exists; repo inactive since 2022. The issue also names ConfigSetting.loads, which the CVE text does not. No PoC or exploitation reported. Nothing marked verified: neither source is a vendor fix statement.","cites":["https://github.com/treeio/treeio/issues/165"]}],"documents":[{"id":96385,"url":"https://www.vulncheck.com/advisories/treeio-through-2.0-insecure-deserialization-rce-via-admin-editable-pickle-fields","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":96523,"url":"https://github.com/treeio/treeio/issues/165","title":"treeio #165: Insecure Pickle Deserialization in ModuleSetting/ConfigSetting (open, no fix)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}