CVE-2026-35464: pyLoad Arbitrary File Write and Code Execution Vulnerability
Summary
CVE-2026-35464: The fix for CVE-2026-33509 (GHSA-r7mc-x6x7-cqxx) added an ADMIN_ONLY_OPTIONS set to block non-admin users from modifying security-critical config options. Affects pyload-ng versions < 0.5.0b3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyLoad is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It is designed to work with a variety of file hosting services and supports plugins for extended functionality. However, a critical vulnerability has been identified that allows non-admin users to exploit the application, leading to arbitrary file writes and potential code execution.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2026-33509, where the 'storage_folder' option is not adequately protected. A user with SETTINGS and ADD permissions can redirect downloads to the Flask session store, allowing them to write a malicious pickle payload. This payload can be executed when an HTTP request is made with the corresponding session cookie, leading to arbitrary code execution. The root cause is a path check that fails to restrict access to the Flask session directory, which is outside the defined safe paths.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can manually restrict access to the 'storage_folder' option by ensuring that only trusted users have SETTINGS and ADD permissions. However, this does not fully mitigate the risk and should not replace a proper fix.
Conclusion
The CVE-2026-35464 vulnerability in pyLoad poses significant risks due to improper handling of configuration options. It is crucial for users to update to the latest version and implement the suggested fixes to safeguard their applications against potential exploitation.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2026-35464 is a vulnerability in pyLoad that allows non-admin users to execute arbitrary code through improper handling of the 'storage_folder' configuration.
Any instance of pyLoad that allows non-admin users to modify the 'storage_folder' option is potentially affected.
An attacker can execute arbitrary commands, read sensitive environment variables, access the filesystem, and potentially pivot to other network resources.
You can use Vulert's playground to check if your application is affected by this vulnerability without any signup required. Visit Vulert Scanner for more information.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
