CVE-2026-53872: picklescan - Arbitrary File Read via Unsafe Pickle Deserialization

Synopsis

An arbitrary file read vulnerability exists in picklescan before version 0.0.35, caused by unsafe pickle deserialization. The vulnerability is reachable over the network and requires no authentication, allowing an unauthenticated remote attacker to chain io.FileIO and urllib.request.urlopen inside a crafted pickle payload to bypass RCE-focused blocklists and exfiltrate arbitrary files from the server. Successful exploitation gives the attacker read access to any file the process can reach, including sensitive system and application files. A patched-image rebuild at version 0.0.35 is available on HarborGuard for environments running an affected version of picklescan.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the service over the network to deliver a crafted pickle payload, as the CVSS vector specifies AV:N.

• AuthenticationNot required

  No credentials or session token are needed; the CVSS vector specifies PR:N, meaning any unauthenticated party who can reach the service can attempt exploitation.

• Victim interactionNot required

  No user action is required to trigger the vulnerability; the CVSS vector specifies UI:N, so exploitation is fully attacker-driven.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the CVSS vector specifies AC:L and AT:N, meaning no race conditions or special environmental factors must align for the attack to succeed.

Blast Radius

• The attacker reads arbitrary files from the server filesystem, including credential files such as /etc/passwd, application configuration files, and private keys accessible to the process.
• Crafted pickle payloads exfiltrate file contents to an attacker-controlled external server via urllib.request.urlopen, so stolen data leaves the environment silently over outbound HTTP or HTTPS.
• Confidentiality of any file readable by the process running picklescan is fully compromised; the CVSS vector specifies VC:H with no integrity or availability impact.