Pyload CVE-2026-35586

The CVSS 6.8 score (medium-high) reflects legitimate severity: authenticated access is required (PR:L), but complexity is high (AC:H), limiting exposure. However, the real-world risk is substantial because it targets a specific but dangerous attack surface-SSL/TLS configuration. The vulnerability requires only SETTINGS-level permission (a common permission for non-admin users in delegated environments) and delivers high confidentiality and integrity impact (C:H/I:H). Unlike many privilege escalations, this one touches cryptographic material: an attacker can redirect the download manager to use attacker-controlled certificates or keys, enabling man-in-the-middle attacks on HTTPS connections or certificate-based authentication spoofing. The high-complexity CVSS component likely reflects the need for prior authentication and conditional exploitation (configuration modification must be followed by a restart or reload to take effect). No KEV confirmation or public exploit code has been reported, placing this in the 'serious but not critically urgent' category; however, organizations running pyLoad with federated or delegated user accounts should prioritize patching because the barrier to exploitation is low once a SETTINGS user is compromised.

A malicious or compromised user with SETTINGS permission on a pyLoad instance logs in and uses the configuration API or web interface to modify the ssl_certfile or ssl_keyfile paths to point to attacker-controlled certificates. Because the authorization check fails due to the name mismatch, the modification succeeds despite the user lacking admin privileges. Upon next download or server restart, pyLoad uses the attacker's certificates, allowing the attacker to intercept and modify downloads or impersonate the server in TLS handshakes. The high attack complexity reflects the need for prior authentication and environmental factors (reloading the configuration), but the impact is substantial: complete compromise of download integrity and confidentiality.