CRITICAL🇵🇱 Wersja polska

CVE-2024-47821

CVSS 9.1v3.1pub. 2024-10-25upd. 2025-03-05

pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved in versions prior to 0.5.0b3.dev87. A file can be downloaded to such a folder by changing the download folder to a folder in `/scripts` path and using the `/flashgot` API to download the file. This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system. Version 0.5.0b3.dev87 fixes this issue.

🤖 AI Analysis
How it works

The `/.pyload/scripts` folder contains scripts that run automatically upon completion of specific actions, such as after a file download completes. An attacker can change the download target folder to a path inside `/scripts` and then use the `/flashgot` API endpoint to download a malicious executable file to that folder. When pyLoad executes a scheduled action (e.g., completes a download), the malicious file is automatically executed, resulting in arbitrary code execution on the server.

Impact

An attacker can execute arbitrary code on the server with pyLoad process privileges, leading to full system compromise, including violation of data confidentiality, integrity, and availability.

Mitigation & patch

Update pyLoad to version 0.5.0b3.dev87 or newer, which removes this vulnerability. As a temporary measure, restrict access to the pyLoad management panel exclusively to trusted users and IP addresses.

Who is affected

pyLoad in versions earlier than 0.5.0b3.dev87

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Pyload

    APP
    Pyload
    0.5.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCECommand Injection
CWE
References

Related vulnerabilities

CVE-2026-33992CRITICAL9.3PL ✓same product

SSRF w PyLoad umożliwia dostęp do metadanych chmury i sieci wewnętrznej

CVE-2024-32880CRITICAL9.1PL ✓same product

pyload: RCE przez upload złośliwego szablonu przez uwierzytelnionego użytkownika

CVE-2023-0435CRITICAL9.8PL ✓same product

Nadmierna powierzchnia ataku w pyload przed wersją 0.5.0b3.dev41

CVE-2023-0297CRITICAL9.8PL ✓same product

Code Injection w pyLoad umożliwiający zdalne wykonanie kodu Python

CVE-2026-41133HIGH8.8same product

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev9...