Tendenci is an open‑source content management system. In versions 15.3.11 and older, the Helpdesk module contains a flaw that allows an authenticated user with staff privileges to run arbitrary code. The vulnerability stems from the run_report function, which deserializes user‑supplied data using Python’s pickle.loads on the helpdesk /reports/ endpoint. Because pickle can instantiate any Python object, a crafted payload can cause the application to execute malicious code when it runs under the web server’s user.

The affected product is Tendenci CMS, versions 15.3.11 and earlier. The Helpdesk module is not enabled by default, but any deployment that has left the module active is vulnerable.

The CVSS base score is 6.8, indicating moderate severity. The EPSS score is below 1%, reflecting a very low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. The attack requires staff‑level authentication to access the report feature; once authenticated, the attacker can execute code with the privileges of the web server user, which typically cannot write or execute outside designated directories.