Remote Code Execution Vulnerability in pyLoad by pyLoad Team
CVE-2026-35463

8.8HIGH

Key Information:

Vendor

Pyload

Status
Pyload
Vendor
CVE Published:
7 April 2026

What is CVE-2026-35463?

In pyLoad, a widely-used open-source download manager, a security vulnerability exists in versions 0.5.0b3.dev96 and earlier. The ADMIN_ONLY_OPTIONS protection mechanism, meant to restrict access to sensitive configuration values, has a significant oversight. While it secures core configuration options, plugin configuration options, such as those in the AntiVirus plugin, remain exposed. This flaw allows a non-admin user with SETTINGS permission to modify the executable path parameter (avfile) in the configuration, potentially leading to remote code execution via subprocess.Popen(). This oversight poses a critical security risk for users and necessitates immediate attention and remediation.

Affected Version(s)

pyload <= 0.5.0b3.dev96

References

https://github.com/pyload/pyload/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/pyload/pyload/commit/c4cf995a2803bdbe3...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.