CVE-2021-33026

This repository contains a functional exploit for CVE-2021-33026, demonstrating remote code execution via Pickle deserialization in Flask-Caching. The PoC crafts a malicious serialized object, stores it in Memcached, and triggers execution by sending a crafted session cookie to the target Flask application.

This repository contains a functional exploit PoC for CVE-2021-33026, demonstrating a deserialization vulnerability in Flask-Caching. The exploit leverages pickle deserialization to achieve remote code execution (RCE) by poisoning a Redis or Memcached cache with a malicious payload.