CVE-2026-35464: pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)
(updated )
The fix for CVE-2026-33509 (GHSA-r7mc-x6x7-cqxx) added an ADMIN_ONLY_OPTIONS set to block non-admin users from modifying security-critical config options. The storage_folder option is not in this set and passes the existing path restriction because the Flask session directory is outside both PKGDIR and userdir. A user with SETTINGS and ADD permissions can redirect downloads to the Flask filesystem session store, plant a malicious pickle payload as a predictable session file, and trigger arbitrary code execution when any HTTP request arrives with the corresponding session cookie.
References
- github.com/advisories/GHSA-4744-96p5-mp2j
- github.com/pyload/pyload
- github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1
- github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j
- github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxx
- nvd.nist.gov/vuln/detail/CVE-2026-33509
- nvd.nist.gov/vuln/detail/CVE-2026-35464
- www.cve.org/CVERecord?id=CVE-2026-33509
Code Behaviors & Features
Detect and mitigate CVE-2026-35464 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →