← Vulnerability feed

Vulnerability record · CVE-2026-35463 · published 7 April 2026

CVE-2026-35463: Pyload-ng project pyload-ng os command injection vulnerability

PPyload Ng Project · Pyload Ng

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts security-critical configuration values (reconnect scripts, SSL certs, proxy credentials) to admin-only access. However, this protection is only applied to core config options, not to plugin config options. The AntiVirus plugin stores an executable path (avfile) in its config, which is passed directly to subprocess.Popen(). A non-admin user with SETTINGS permission can change this path to achieve remote code execution.

8.8 CVSS 3.1 High EPSS 0.91% · top 41.8% CWE-78 · OS command injection
8.8CVSS 3.1 base score
0.91%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts security-critical configuration values (reconnect scripts, SSL certs, proxy credentials) to admin-only access. However, this protection is only applied to core config options, not to plugin config options. The AntiVirus plugin stores an executable path (avfile) in its config, which is passed directly to subprocess.Popen(). A non-admin user with SETTINGS permission can change this path to achieve remote code execution.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1 Patch
https://github.com/pyload/pyload/security/advisories/GHSA-w48f-wwwf-f5fr ExploitMitigationVendor Advisory

Track CVE-2026-35463 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-54802Pyload-ng project pyload-ng path traversal vulnerabilitypyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path tra…EPSS 1.2%9.3CVE-2026-35459Pyload-ng project pyload-ng server-side request forgery (ssrf) vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vu…EPSS 0.38%8.8CVE-2026-33509Pyload improper privilege management vulnerabilitypyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API e…EPSS 0.58%8.8CVE-2026-33511Pyload insecure direct object reference vulnerabilitypyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator i…EPSS 0.62%8.8CVE-2024-22416Pyload-ng project pyload-ng cross-site request forgery vulnerabilitypyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since t…EPSS 0.95%8.3CVE-2026-42313Pyload-ng project pyload-ng incorrect authorization vulnerabilitypyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SE…EPSS 0.39%8.1CVE-2026-32808Pyload path traversal vulnerabilitypyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password v…EPSS 0.46%7.7CVE-2026-35187Pyload-ng project pyload-ng server-side request forgery (ssrf) vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api…EPSS 0.37%

Source: NIST National Vulnerability Database (record CVE-2026-35463), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.