CVE-2026-124318

Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.getformatstrings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord formatstrings field through the...