Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2026-35464
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-07 Apr, 2026 | 15:17
Updated At-23 Apr, 2026 | 15:13

pyLoad is a free and open-source download manager written in Python. The fix for CVE-2026-33509 added an ADMIN_ONLY_OPTIONS set to block non-admin users from modifying security-critical config options. The storage_folder option is not in this set and passes the existing path restriction because the Flask session directory is outside both PKGDIR and userdir. A user with SETTINGS and ADD permissions can redirect downloads to the Flask filesystem session store, plant a malicious pickle payload as a predictable session file, and trigger arbitrary code execution when any HTTP request arrives with the corresponding session cookie. This vulnerability is fixed with commit c4cf995a2803bdbe388addfc2b0f323277efc0e1.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.17.5HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE Matches
pyload
pyload
>>pyload>>Versions before 2026-04-02(exclusive)
cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-502Secondarysecurity-advisories@github.com
CWE-863Secondarysecurity-advisories@github.com
CWE ID: CWE-502
Type: Secondary
Source: security-advisories@github.com
CWE ID: CWE-863
Type: Secondary
Source: security-advisories@github.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1security-advisories@github.com
Patch
https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2jsecurity-advisories@github.com
Exploit
Vendor Advisory
Mitigation
https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxxsecurity-advisories@github.com
Exploit
Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33509security-advisories@github.com
Third Party Advisory
https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j134c704f-9b21-4f2e-91b3-4a467353bcc0
Exploit
Vendor Advisory
Mitigation
Hyperlink: https://github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j
Source: security-advisories@github.com
Resource:
Exploit
Vendor Advisory
Mitigation
Hyperlink: https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxx
Source: security-advisories@github.com
Resource:
Exploit
Vendor Advisory
Hyperlink: https://www.cve.org/CVERecord?id=CVE-2026-33509
Source: security-advisories@github.com
Resource:
Third Party Advisory
Hyperlink: https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Resource:
Exploit
Vendor Advisory
Mitigation
Change History
0Changes found
Details not found