treeio vulnerabilities

Products

• treeio/treeio 1

Latest treeio CVEs

Newest publication first

1. CVE-2026-124318 Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields

   Published 2026-11-07

   High·CVSS 8.6

   Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strin...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.