CVE-2026-124318

Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.getformatstrings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord formatstrings field through the...

CVE-2026-124318

Treeio versions through 2.0 are vulnerable to an insecure deserialization flaw in UpdateRecord.get_format_strings and ModuleSetting.loads. This vulnerability allows staff users to execute arbitrary Python code as the web server user. An attacker can achieve Remote Code Execution (RCE) by storing ...

CVE-2026-124318 Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields

Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.getformatstrings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord formatstrings field through the...

EUVD-2026-119272

Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.getformatstrings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord formatstrings field through the...