pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication.
An attacker with access to a user account in pyload changes the configuration pointing to the download folder to an arbitrary location. Then uploads a prepared template file (CWE-434: Unrestricted Upload of File with Dangerous Type) to the specified folder. The uploaded template is subsequently processed by the application, leading to execution of the malicious code contained within it on the server side.
An attacker can obtain remote code execution (RCE) on the server hosting the pyload application, which potentially enables full system takeover, access to sensitive data, and further actions in the infrastructure.
At the time of CVE publication, no patch was available. Monitor the project repository (https://github.com/pyload/pyload) and apply the patch immediately after its release. Until a patch becomes available, it is recommended to restrict access to the pyload interface only to trusted users and to isolate the server at the network level (firewall).
pyload (open-source Download Manager) — versions indicated in the vendor's references; at the time of publication no patch was available
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HPyload
APPPyload≤ 0.5.0
Related vulnerabilities
SSRF w PyLoad umożliwia dostęp do metadanych chmury i sieci wewnętrznej
RCE w pyLoad przez zapis pliku wykonywalnego do folderu /scripts
Nadmierna powierzchnia ataku w pyload przed wersją 0.5.0b3.dev41
Code Injection w pyLoad umożliwiający zdalne wykonanie kodu Python
pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev9...