VulnSocial

CVE-2026-35464Disclosure(pyload / pyload)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

pyLoad is a free and open-source download manager written in Python. The fix for CVE-2026-33509 added an ADMIN_ONLY_OPTIONS set to block non-admin users from modifying security-critical config options. The storage_folder option is not in this set and passes the existing path restriction because the Flask session directory is outside both PKGDIR and userdir. A user with SETTINGS and ADD permissions can redirect downloads to the Flask filesystem session store, plant a malicious pickle payload as a predictable session file, and trigger arbitrary code execution when any HTTP request arrives with the corresponding session cookie. This vulnerability is fixed with commit c4cf995a2803bdbe388addfc2b0f323277efc0e1.

pyload CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Weakness type (CWE)
CWE-502CWE-863

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pyload

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-04-05); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
pyload
Products
pyload

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-05: 1Mentions · 2026-04-07: 1Technical Details · 2026-04-05: 104-0504-07
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-04-051
Disclosure1
2026-04-071
General1
Full discourse2 posts
  • CVE@CVEnew
    General

    CVE-2026-35464 pyLoad is a free and open-source download manager written in Python. The fix for CVE-2026-33509 added an ADMIN_ONLY_OPTIONS set to block non-admin users from modifyin… https://www.cve.org/CVERecord?id=CVE-2026-35464

    Post summary

    The statement references CVE‑2026‑35464 but provides no technical specifics, PoC, exploit details, or patch information, classifying it as a general mention.

    00000154
    57.0K followersView on X
  • PulsePatch.io@pulsepatchio
    Disclosure

    Vulnerability in pyLoad (CVE-2026-35464) allows arbitrary file write to Flask session store, leading to RCE. This is an incomplete fix for a prior CVE. Review pyLoad deployments. #infosec #pyLoad #RCE https://www.pulsepatch.io/posts/cve-2026-35464-pyload-arbitrary-file-write-rce

    Post summary

    The post announces CVE-2026-35464, noting it allows arbitrary file writes to the Flask session store that enable remote code execution, but no PoC, exploit code, or patch is offered.

    0000040
    4 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apppyloadpyload---

Explore more

Back to dashboardpyload CVEspyload vulnerabilities