CVE-2026-124318 | Treeio up to 2.0 format_strings deserialization

A vulnerability, which was classified as problematic, has been found in Treeio up to 2.0. Affected is the function UpdateRecord.get_format_strings/ModuleSetting.loads. The manipulation of the argument format_strings leads to deserialization. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability is traded as CVE-2026-124318. It is possible to initiate the attack remotely. There is no exploit available.VulDB Recent EntriesRead More