piccolo-orm piccolo_admin vulnerabilities

Latest piccolo-orm piccolo_admin CVEs

Newest publication first

1. CVE-2026-55485 Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

   Published 2026-08-28

   High·CVSS 8.8 EPSS 0.56%

   Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured use...

2. CVE-2024-30248 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

   Published 2024-04-02

   High·CVSS 7.7 EPSS 0.49%

   Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary ac...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.