VulnSocial

CVE-2026-35463Disclosure(pyload-ng_project / pyload-ng)

LOWCVSS 8.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch pyload-ng_project pyload-ng systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts security-critical configuration values (reconnect scripts, SSL certs, proxy credentials) to admin-only access. However, this protection is only applied to core config options, not to plugin config options. The AntiVirus plugin stores an executable path (avfile) in its config, which is passed directly to subprocess.Popen(). A non-admin user with SETTINGS permission can change this path to achieve remote code execution.

pyload-ng_project CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pyload-ng

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-04-07)
  • 3 total mentions across 2 days

Affected systems

Vendors
pyload-ng_project
Products
pyload-ng

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-04-05: 1Mentions · 2026-04-07: 2Patch / Workaround · 2026-04-05: 1Technical Details · 2026-04-05: 1Technical Details · 2026-04-07: 104-0504-07
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-051
Disclosure1
2026-04-072
Disclosure1General1
Full discourse3 posts
  • CVE@CVEnew
    General

    CVE-2026-35463 pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts security-crit… https://www.cve.org/CVERecord?id=CVE-2026-35463

    Post summary

    The post references CVE-2026-35463 affecting pyLoad and briefly mentions an ADMIN_ONLY_OPTIONS protection issue, but lacks details about the vulnerability, exploit availability, patches, or active exploitation.

    00000150
    57.0K followersView on X
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2026-35463: HIGH] pyLoad, a Python-based download manager, has a security flaw allowing non-admin users to exploit the AntiVirus plugin for remote code execution due to insufficient protection on specif...#cve,CVE-2026-35463,#cybersecurity https://cvefind.com/CVE-2026-35463

    Post summary

    A new RCE flaw has been disclosed in pyLoad's AntiVirus plugin, but no exploit, patch, or active use information is available.

    0000039
    619 followersView on X
  • PulsePatch.io@pulsepatchio
    Disclosure

    A high-severity OS command injection (CVE-2026-35463) impacts `pyLoad`. This vulnerability allows for remote code execution. Monitor `pyLoad` advisories for patch availability. #infosec #RCE #vulnerability https://www.pulsepatch.io/posts/cve-2026-35463-pyload-os-command-injection

    Post summary

    High‑severity OS command injection CVE‑2026‑35463 in pyLoad enables remote code execution; users should watch pyLoad advisories for patches.

    0000045
    4 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apppyload-ng_projectpyload-ng-python-

Explore more

Back to dashboardpyload-ng_project CVEspyload-ng vulnerabilities