TI-2026-25905 Aliases CVE-2026-33509 GHSA-r7mc-x6x7-cqxx

pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

HIGH 73CWE-269Published 2026-03-24 · Updated 2026-03-26

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

pyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API endpoint allows users with the non-admin SETTINGS permission to modify any configuration option without restriction. The reconnect.script config option controls a file path that is passed directly to subprocess.run() in the thread manager's reconnect logic. A SETTINGS user can set this to any executable file on the system, achieving Remote Code Execution. The only validation in set_config_value() is a hardcoded check for general.storage_folder — all other security-critical settings including reconnect.script are writable without any allowlist or path restriction. This issue has been patched in version 0.5.0b3.dev97.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0055 46th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed pyload (pyload): 0.5.0b3.dev97

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pyload	pyload	0.4.0 to before 0.5.0b3.dev97	0.5.0b3.dev97	Patch available	CNA
—	pyload-ng (PyPI)	0.4.0 – 0.5.0b3.dev96	—	No fix listed	GHSA-r7mc-x6x7-cqxx

pyload Vendorpyload Affected 0.4.0 to before 0.5.0b3.dev97 Fixed in 0.5.0b3.dev97 Patch available CNA
pyload-ng (PyPI) Vendor— Affected 0.4.0 – 0.5.0b3.dev96 Fixed in — No fix listed GHSA-r7mc-x6x7-cqxx

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:pyload:pyload::::::::	0.4 – 0.4.20	Vulnerable	pyload
cpe:2.3:a:pyload-ng_project:pyload-ng::::::python::*	0.5.0a5.dev528 to before 0.5.0b3.dev97	Vulnerable	Pyload-ng Project

cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:* Versions 0.4 – 0.4.20 Vulnerable ·pyload
cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:* Versions 0.5.0a5.dev528 to before 0.5.0b3.dev97 Vulnerable ·Pyload-ng Project

Remediation

Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev97

Timeline

2026-10-02 Threatist record created from CVE-2026-33509
2026-10-03 Alias added: GHSA-r7mc-x6x7-cqxx

References

Exploit 1

https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxx

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-33509

Other 2

TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
TI-2026-25907 pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad CVSS 4.0HIGH 8.8
TI-2024-32088 pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API CVSS 3.1CRITICAL 9.1
TI-2026-29761 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) CVSS 3.1HIGH 8.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences