CVE-2026-35464: pyLoad Arbitrary File Write and Code Execution Vulnerability
Summary
CVE-2026-35464: The fix for CVE-2026-33509 (GHSA-r7mc-x6x7-cqxx) added an ADMIN_ONLY_OPTIONS set to block non-admin users from modifying security-critical config options. Affects pyload-ng versions < 0.5.0b3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyLoad is an open-source download manager written in Python that allows users to manage and automate the downloading of files from various sources. It features a web interface, supports multiple download protocols, and provides plugins for additional functionality. However, a vulnerability has been identified that allows non-admin users to exploit the application, leading to arbitrary file writes and potential code execution.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2026-33509, where the 'storage_folder' option is not restricted to admin-only settings. This oversight allows users with SETTINGS and ADD permissions to redirect downloads to the Flask session store, where they can plant malicious payloads. When a session cookie is sent with an HTTP request, the application deserializes the malicious payload, leading to arbitrary code execution. This vulnerability can be exploited without authentication, allowing attackers to execute commands with the privileges of the pyLoad service user.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can manually restrict access to the 'storage_folder' option by modifying the configuration file to prevent non-admin users from changing it. Ensure that the path checks are correctly implemented to block writing to the Flask session directory.
Conclusion
The CVE-2026-35464 vulnerability in pyLoad poses a significant risk by allowing arbitrary code execution through improper session management. It is crucial for users to update their installations and apply the necessary configuration changes to mitigate this risk.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2026-35464 is a vulnerability in pyLoad that allows non-admin users to execute arbitrary code by exploiting the application's session management.
Any instance of pyLoad that allows non-admin users to modify the 'storage_folder' setting is potentially affected.
An attacker can execute arbitrary commands, read sensitive environment variables, access the filesystem, and pivot to other network resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
