pyLoad has Improper Neutralization of Special Elements used in an OS Command

published 2026-04-04 7 mo ago modified 2026-07-13 3 mo ago also GHSA-w48f-wwwf-f5fr , PYSEC-2026-2267 , EUVD-2026-19659

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 58%
public exploits: 0; none known

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts security-critical configuration values (reconnect scripts, SSL certs, proxy credentials) to admin-only access. However, this protection is only applied to core config options, not to plugin config options. The AntiVirus plugin stores an executable path (avfile) in its config, which is passed directly to subprocess.Popen(). A non-admin user with SETTINGS permission can change this path to achieve remote code execution.

Patch / fix

fixed in 1 links 1

pypi pyload-ng 0.5.0b3.dev97

github.com/pyload/pyload@c4cf995 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 7 mo ago (2026-04-08)

Exploit prediction

0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/pyload/pyload/security/advisories/GHSA-w48f-wwwf-f5fr referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	pyload-ng	<=0.5.0b3.dev96 <0.5.0b3.dev97	0.5.0b3.dev97

Affected products

pyload pyload

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

github.com /pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1
web, patch
github.com /pyload/pyload/security/advisories/GHSA-w48f-wwwf-f5fr
web, exploit, mitigation, vendor-advisory, evidence
nvd.nist.gov /vuln/detail/CVE-2026-35463
advisory
github.com /pyload/pyload
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary