Plataforma
python
Componente
tendenci
Corregido en
15.3.13
15.3.12
CVE-2026-23946 describes a critical Remote Code Execution (RCE) vulnerability found in the Tendenci Helpdesk module. This flaw allows an authenticated user with staff security level to execute arbitrary code by exploiting the /reports/ endpoint. The vulnerability impacts Tendenci versions 7.5.2 and earlier, stemming from the continued use of Python's pickle module for deserialization, a problem initially identified in CVE-2020-14942. A patch is available in version 15.3.12.
Successful exploitation of CVE-2026-23946 grants an attacker the ability to execute arbitrary code on the server running the Tendenci application. This could lead to complete system compromise, data exfiltration, and potential disruption of services. The scope of the attack is limited to the user account under which the Tendenci application runs, but this account often has significant privileges within the web hosting environment. The vulnerability's reliance on the pickle deserialization mechanism mirrors the risks associated with similar vulnerabilities like CVE-2020-14942, where malicious pickle files can be crafted to execute arbitrary commands. Given the module is not enabled by default, the immediate blast radius is reduced, but organizations that have enabled the Helpdesk module are at significant risk.
CVE-2026-23946 was publicly disclosed on 2026-01-21. The vulnerability builds upon a previously identified issue (CVE-2020-14942) that was not fully addressed. Public proof-of-concept exploits are likely to emerge given the vulnerability's nature and the availability of tools for crafting malicious pickle files. The EPSS score is likely to be assessed as Medium, reflecting the potential for RCE and the relatively straightforward exploitation process. Check CISA KEV for updates.
Organizations using Tendenci for website content management and specifically those who have enabled the Helpdesk module are at risk. Shared hosting environments where multiple Tendenci instances are running under a single user account are particularly vulnerable, as a compromise of one instance could potentially lead to the compromise of others. Legacy Tendenci installations that have not been regularly updated are also at increased risk.
• linux / server: Monitor Tendenci application logs for requests to /reports/ containing unusual or malformed data. Use journalctl -f -u tendenci to observe real-time log activity.
grep -i 'pickle' /var/log/tendenci/application.log• python: If you have access to the Tendenci application code, review the run_report() function for the use of pickle.load() and ensure that input is properly validated before deserialization.
• generic web: Use curl to test the /reports/ endpoint with a benign payload and then with a known malicious pickle payload (in a controlled environment) to verify the vulnerability's presence.
curl -X POST -d '...' /reports/disclosure
Estado del Exploit
EPSS
0.36% (58% percentil)
CISA SSVC
Vector CVSS
The primary mitigation for CVE-2026-23946 is to upgrade Tendenci to version 15.3.12 or later, which includes the necessary fix. If an immediate upgrade is not possible, consider temporarily disabling the Helpdesk module to reduce the attack surface. As a short-term workaround, implement strict input validation on the /reports/ endpoint to prevent the processing of potentially malicious data. Web Application Firewalls (WAFs) can be configured to block requests containing suspicious pickle data. Monitor Tendenci application logs for unusual activity, particularly related to the /reports/ endpoint. After upgrading, confirm the vulnerability is resolved by attempting to trigger the report generation process with a known malicious pickle payload (in a controlled environment).
Actualice Tendenci CMS a la versión 15.3.12 o superior. Esta versión corrige la vulnerabilidad de deserialización insegura en el módulo Helpdesk. La actualización evitará la ejecución remota de código por usuarios autenticados con privilegios de personal.
Análisis de vulnerabilidades y alertas críticas directamente en tu correo.
CVE-2026-23946 is a Remote Code Execution vulnerability in the Tendenci Helpdesk module, allowing authenticated staff users to execute code via the /reports/ endpoint due to insecure pickle deserialization.
You are affected if you are using Tendenci versions 7.5.2 or earlier and have the Helpdesk module enabled. Even if the module is not enabled, review the code for potential vulnerabilities.
Upgrade Tendenci to version 15.3.12 or later. If immediate upgrade is not possible, disable the Helpdesk module or implement strict input validation.
While active exploitation is not confirmed, the vulnerability's nature and the availability of pickle exploitation techniques suggest it is likely to be targeted.
Refer to the official Tendenci security advisory on their website or through their security mailing list.
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Sube tu archivo requirements.txt y te decimos al instante si estás afectado.