PT-2026-44080 · Unknown · Relate Lms

Emreefedogan · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-47161

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RELATE versions prior to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb

Description RELATE LMS configures its Celery workers to accept and deserialize untrusted pickle data. Pickle is a Python module used for serializing and deserializing objects. An attacker with access to the message broker can execute arbitrary commands on the host server. Due to missing network isolation in the code execution sandbox, an authenticated student can achieve full Remote Code Execution (RCE) on the host system.

Recommendations Update to the version containing commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-47161

Affected Products

Relate Lms

References · 4

• 🔥 https://github.com/inducer/relate/security/advisories/GHSA-4mwh-mwv4-m252 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47161 · Security Note
• https://github.com/inducer/relate/commit/d66ba5659b459bf1ba56b7109b5f9ecf197cbefb · Note
• https://twitter.com/CVEnew/status/2059718101936337083 · Twitter Post