CVE-2024-47821: pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

October 28, 2024 (updated June 8, 2026)

The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved. A file can be downloaded to such a folder by changing the download folder to a folder in /scripts path and using the /flashgot API to download the file.

References

github.com/advisories/GHSA-w7hq-f2pj-c53g
github.com/pyload/pyload/commit/48f59567393a19263c8a0285256a7537dc9ce109
github.com/pyload/pyload/security/advisories/GHSA-w7hq-f2pj-c53g
github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2024-302.yaml
nvd.nist.gov/vuln/detail/CVE-2024-47821

Code Behaviors & Features

Detect and mitigate CVE-2024-47821 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →