Executive brief
Tendenci is an open-source web-based CMS and membership management platform with an optional Helpdesk module for managing support tickets. A flaw in the Helpdesk module allows staff-level users (ticket handlers) to execute arbitrary code on the server by exploiting unsafe deserialization of pickled Python objects. This represents a critical security gap since staff roles are commonly assigned to non-administrative ticket operators.
Technical details
A deserialization vulnerability exists in the Tendenci Helpdesk module's run_report() function in tendenci/apps/helpdesk/views/staff.py (line 1062), which unsafely uses pickle.loads() on user-supplied data. This is an incomplete patch of the earlier CVE-2020-14942, where ticket_list() was correctly fixed to use safe JSON deserialization, but run_report() was overlooked. An authenticated user with staff-level privileges (is_staff role) can craft malicious pickled objects and send them to the /helpdesk/reports/ endpoint to achieve remote code execution. The attack requires staff privileges and user interaction, and the damage is scoped to the permissions of the web server process (typically www-data), which generally lacks write and execute permissions beyond upload directories. Patch is available in version 15.3.12 and later.
Affected products
- Tendenci Tendenci 15.3.11 and earlier
Timeline
- 2026-01-21: disclosed: Vulnerability published via GitHub Security Advisory
- 2026-01-21: patched: Fix released in version 15.3.12