CVE-2013-5093

Graphite 0.9.5-0.9.10 - Remote Code Execution via Unsafe Pickle Deserialization

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2013-5093. PoCs published by Metasploit, Charlie Eriksen, funkypickle, including Metasploit module exploits/unix/webapp/graphite_pickle_exec.

AI-analyzed exploit summary This Metasploit module exploits a remote code execution vulnerability in Graphite Web (versions 0.9.5 to 0.9.10) by sending a malicious pickle payload via HTTP POST to the 'render' endpoint. The payload leverages Python's pickle deserialization to execute arbitrary commands.

Description

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremoteunix
https://www.exploit-db.com/exploits/27752

This Metasploit module exploits a remote code execution vulnerability in Graphite Web (versions 0.9.5 to 0.9.10) by sending a malicious pickle payload via HTTP POST to the 'render' endpoint. The payload leverages Python's pickle deserialization to execute arbitrary commands.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Graphite Web 0.9.5 to 0.9.10
No auth needed
Prerequisites: Network access to the Graphite Web interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Charlie Eriksen, funkypickle · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/graphite_pickle_exec.rb

This Metasploit module exploits a remote code execution vulnerability in Graphite Web (versions 0.9.5 to 0.9.10) via unsafe pickle deserialization. It sends a crafted payload to the 'render' endpoint, triggering arbitrary command execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Graphite Web 0.9.5 to 0.9.10
No auth needed
Prerequisites: Network access to the Graphite Web instance · Python or compatible command execution environment
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/27752
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/96436
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/61894
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/54556

Scores

EPSS 0.8361
EPSS Percentile 99.3%

Details

CWE
CWE-94
Status published
Products (7)
graphite_project/graphite 0.9.5
graphite_project/graphite 0.9.6
graphite_project/graphite 0.9.7
graphite_project/graphite 0.9.8
graphite_project/graphite 0.9.9
graphite_project/graphite 0.9.10
pypi/graphite-web 0.9.5 - 0.9.11PyPI
Published Sep 27, 2013
Tracked Since Feb 18, 2026