CVE-2026-45272 PoxenStudio CVE debrief

Who should care

Administrators and defenders of MyBooks deployments should assess exposure and prioritize patching to version 3.42.0. They should also verify the integrity of the auto.py file and monitor for suspicious activity.

Why it matters

CVE-2026-45272 is a critical vulnerability in MyBooks that allows an administrator to inject arbitrary Python statements, potentially disclosing data, modifying files, establishing persistence, or disrupting the service. The issue is fixed in version 3.42.0, and administrators and defenders should prioritize patching and verify the integrity of the auto.py file.

• Potential data disclosure with the privileges of the application service account
• Potential file modification with the privileges of the application service account
• Potential persistence establishment with the privileges of the application service account
• Potential service disruption with the privileges of the application service account

Technical summary

The vulnerability exists in the AdminSettings.post handler in webserver/handlers/admin.py, which accepts SOCIAL_AUTH key names without validating quotes or newline characters. These names are then concatenated into the generated Python source file auto.py without escaping. An administrator can submit a crafted SOCIAL_AUTH key name that closes the settings dictionary and injects arbitrary Python statements. The application later executes those statements because SettingsLoader.loadfile imports auto.py as a module, and setting autoreload to true invokes restart_async so a process supervisor restarts the service and triggers the import.

Defensive priority

Administrators and defenders should prioritize patching to version 3.42.0, verify the integrity of the auto.py file, and monitor for suspicious activity.

Recommended defensive actions

• Patch MyBooks to version 3.42.0
• Verify the integrity of the auto.py file
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed in MyBooks versions 3.41.2 and earlier. The fix is available in version 3.42.0. However, the exact scope of affected deployments and the number of exploited instances are unknown.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.