CVE-2026-124318

HIGH 7.2

Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render.

CWE	CWE-502
Vendor	treeio
Product	treeio
Published	Nov 7, 2026

Stay Ahead of the Next One

Get instant alerts for treeio treeio

Be the first to know when new high vulnerabilities affecting treeio treeio are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

treeio / treeio

0 ≤ 2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/treeio/treeio/issues/165 github.com: https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1101-L1109 github.com: https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1265-L1273 github.com: https://github.com/treeio/treeio vulncheck.com: https://www.vulncheck.com/advisories/treeio-through-2.0-insecure-deserialization-rce-via-admin-editable-pickle-fields

Credits

MJ DHURGESH