CVE-2026-45306: pyLoad account takeover via session directory bypass in storage_folder

Executive brief

pyLoad, a popular download manager, contains a flaw where an administrator can bypass security restrictions to access sensitive session files. By changing the application's storage folder to the internal session directory, an attacker can steal login tokens of other users. This allows the attacker to take over other user accounts and gain unauthorized access to the system.

Technical details

An incomplete fix for CVE-2026-33509 in pyLoad allows a directory bypass via the 'storage_folder' configuration. While the original fix blocked setting the storage folder to the package or user directories, it failed to include the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker with administrative privileges can update the 'storage_folder' to point to this session directory and then use the '/files/get/' endpoint to download session files of other users. This results in session hijacking and full account takeover. The vulnerability is rooted in CWE-706 (Use of Incorrectly-Resolved Name or Reference) within 'src/pyload/core/api/__init__.py'.

Affected products

• pyLoad pyload-ng <= 0.5.0b3.dev99

Timeline

• 2026-05-08: disclosed: Initial disclosure by GammaC0de
• 2026-05-14: advisory: GitHub Advisory published

References

• https://api.github.com/users/NSSYS
• https://github.com/NSSYS
• https://api.github.com/users/NSSYS/gists%7B/gist_id%7D
• https://api.github.com/users/NSSYS/repos
• https://avatars.githubusercontent.com/u/29173071?v=4
• https://api.github.com/users/NSSYS/events%7B/privacy%7D