Iniciar sesión
Deutsch English Español Polski
Media

pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad

  • Publicada: 14.05.2026
  • Actualizado: 11.10.2026 14:18

Summary

The fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover.

Details

The fix in src/pyload/core/api/__init__.py:

python
directories = [PKGDIR, userdir]
if any(directories[0].startswith(d) for d in directories[1:]):
    return  # blocked

But the Flask session directory is:

python
session_storage_path = os.path.join(api.get_cachedir(), "flask")
# = /tmp/pyLoad/flask  ← NOT blocked by fix

Attack Chain

  1. Attacker (admin) sets storage_folder = /tmp/pyLoad/flask
  2. Fix does NOT block this — /tmp/pyLoad/flask not inside PKGDIR or userdir
  3. Attacker requests GET /files/get/<victim_session_filename>
  4. send_from_directory('/tmp/pyLoad/flask', session_file) serves victim's session
  5. Attacker uses stolen session → Account Takeover

PoC

<img width="592" height="408" alt="POC" src="https://github.com/user-attachments/assets/936b9f56-325b-437d-9edd-e0d5bb995187" />
python
import os

PKGDIR = "/usr/lib/python3/dist-packages/pyload"
userdir = os.path.expanduser("~/.pyload")
session_dir = "/tmp/pyLoad/flask"

correct_case = lambda x: x
directories = [
    correct_case(os.path.join(os.path.realpath(d), ""))
    for d in [session_dir, PKGDIR, userdir]
]
blocked = any(directories[0].startswith(d) for d in directories[1:])

print(f"Fix blocks session_dir: {blocked}")
# Output: Fix blocks session_dir: False  ← BYPASS CONFIRMED

Impact

Authenticated admin can steal sessions of other users → Account Takeover.

Suggested Fix

python
blocked_dirs = [PKGDIR, userdir, api.get_cachedir()]
directories = [
    os.path.join(os.path.realpath(d), "")
    for d in [value] + blocked_dirs
]
if any(directories[0].startswith(d) for d in directories[1:]):
    return

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Python (PyPI) pyload-ng <= 0.5.0b3.dev99 sin corrección

Referencias

Puntuación CVSS 6.5/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Debilidad (CWE)
CWE-706
Plataforma
Python (PyPI)
Paquete
pyload-ng
Publicada
14.05.2026
Actualizado
11.10.2026 14:18

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-2998 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-w727-595x-pc3r - CC BY 4.0

Historial de vulnerabilidades: pyload-ng

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (58) en el archivo
Entradas en total
58
Primera → última
01.2023 10.2026
Sin corrección
24
Explotada en ataques
0

Distribución por gravedad

  • Crítica 9
  • Alta 23
  • Media 25
  • Baja 1

Divulgaciones por año

Gravedad:
  1. pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
    Alta · 8.1 ghsa-68w4-83fh-f2w8 >= 0.5.0b3.dev1, <= 0.5.0b3.dev101 sin corrección
  2. pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
    Alta · 7.5 ghsa-jq7h-wrvp-3rgx <= 0.5.0b3.dev101 sin corrección
  3. pyLoad: Api.set_user_permission never invalidates the target's session
    Alta · 7.5 ghsa-889w-m37p-88m5 >= 0.5.0b3.dev98, <= 0.5.0b3.dev101 sin corrección
  4. pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
    Alta ghsa-fr26-jjhm-638c <= 0.5.0b3.dev101 sin corrección
  5. pyLoad has an authentication bypass in API key validation (check_apikey cache)
    Alta · 8.1 ghsa-r44w-v6gf-x3p6 < 0.5.0b3.dev101 0.5.0b3.dev101
  6. pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal
    Alta · 8.7 CVE-2026-45348 <= 0.5.0b3.dev99 sin corrección
  7. pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad esta entrada
    Media · 6.5 CVE-2026-45306 <= 0.5.0b3.dev99 sin corrección
  8. PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
    Alta · 8.1 CVE-2026-42315 < 0.5.0b3.dev100 0.5.0b3.dev100
  9. pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
    Alta · 8.3 CVE-2026-42313 < 0.5.0b3.dev100 0.5.0b3.dev100
  10. pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
    Alta · 8.8 CVE-2026-41133 <= 0.5.0b3.dev97 sin corrección
  11. pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)
    Alta · 7.5 CVE-2026-35464 <= 0.5.0b3 sin corrección
  12. pyLoad: Improper Neutralization of Special Elements used in an OS Command
    Alta · 8.8 CVE-2026-35463 <= 0.5.0b3.dev96 sin corrección
  13. pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)
    Crítica CVE-2026-35459 <= 0.5.0b3.dev96 sin corrección
  14. pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter
    Alta · 7.7 CVE-2026-35187 <= 0.5.0b3.dev96 sin corrección
  15. pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
    Crítica CVE-2026-33992 <= 0.5.0b3.dev96 sin corrección
  16. pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
    Alta · 7.5 CVE-2026-33509 >= 0.4.0, <= 0.5.0b3.dev96 sin corrección
  17. pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
    Alta · 7.1 CVE-2026-29778 >= 0.5.0b3.dev13, < 0.5.0b3.dev97 0.5.0b3.dev97
  18. pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters
    Alta · 8.1 CVE-2025-61773 < 0.5.0b3.dev91 0.5.0b3.dev91
  19. Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
    Alta CVE-2025-57751 < 0.5.0b3.dev92 0.5.0b3.dev92
  20. PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
    Alta CVE-2025-55156 < 0.5.0b3.dev91 0.5.0b3.dev91
  21. pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)
    Crítica · 9.8 CVE-2025-54802 < 0.5.0b3.dev90 0.5.0b3.dev90
  22. `pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write
    Alta · 7.5 CVE-2025-54140 >= 0.5.0b3.dev89, < 0.5.0b3.dev90 0.5.0b3.dev90
  23. pyLoad vulnerable to XSS through insecure CAPTCHA
    Crítica · 9.8 CVE-2025-53890 < 0.20 0.20
  24. pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages
    Alta · 7.5 CVE-2025-7346 <= 0.5.0b3.dev88 sin corrección
  25. pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API
    Alta · 9.1 CVE-2024-47821 < 0.5.0b3.dev87 0.5.0b3.dev87
  26. pyload-ng vulnerable to RCE with js2py sandbox escape
    Crítica · 9.8 CVE-2024-39205 <= 0.5.0b3.dev85 sin corrección
  27. pyLoad allows upload to arbitrary folder lead to RCE
    Crítica · 9.1 CVE-2024-32880 <= 0.5.0 sin corrección
  28. Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
    Crítica · 9.6 CVE-2024-22416 < 0.5.0b3.dev78 0.5.0b3.dev78
  29. pyload Unauthenticated Flask Configuration Leakage vulnerability
    Alta · 7.5 CVE-2024-21644 < 0.5.0b3.dev77 0.5.0b3.dev77
  30. Download to arbitrary folder can lead to RCE
    Alta · 7.6 CVE-2023-47890 < 0.5.0b3.dev75 0.5.0b3.dev75
  31. Improper Certificate Validation in pyload-ng
    Alta · 7.4 CVE-2023-0509 < 0.5.0b3.dev44 0.5.0b3.dev44
  32. Excessive Attack Surface in pyload-ng
    Crítica · 9.8 CVE-2023-0435 < 0.5.0b3.dev41 0.5.0b3.dev41
  33. Code Injection in pyload-ng
    Crítica · 9.8 CVE-2023-0297 < 0.5.0b3.dev31 0.5.0b3.dev31

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.