Is CVE-2026-45306 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45306 being exploited in the wild.

How severe is CVE-2026-45306?

Medium severity, with a CVSS score of 6.5, published 28 May 2026.

Which products and versions are affected?

pyLoad Next Generation <= 0.5.0b3.dev99; pyload-ng (PyPI) <= 0.5.0b3.dev99, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev99.

Is there a fix for CVE-2026-45306?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45306 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45306?

Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45306: pyLoad account takeover via session directory bypass in storage_folder

Q: Is there a fix for CVE-2026-45306?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-45306 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45306?

Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45306 · Severity: medium · CVSS 6.5 · Published 2026-05-28

pyLoad, a popular download manager, contains a flaw where an administrator can bypass security restrictions to access sensitive session files. By changing the application's storage folder to the internal session directory, an attacker can steal login tokens of other users. This allows the attacker to take over other user accounts and gain unauthorized access to the system.

Technologies: pyLoad Next Generation, pyload-ng (PyPI). Vendors: pyLoad, PyPI.

Quick answers

Is CVE-2026-45306 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45306 being exploited in the wild.
How severe is CVE-2026-45306?: Medium severity, with a CVSS score of 6.5, published 28 May 2026.
Which products and versions are affected?: pyLoad Next Generation <= 0.5.0b3.dev99; pyload-ng (PyPI) <= 0.5.0b3.dev99, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev99.
Is there a fix for CVE-2026-45306?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45306 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45306?: Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incomplete fix for CVE-2026-33509 in pyLoad allows a directory bypass via the 'storage_folder' configuration. While the original fix blocked setting the storage folder to the package or user directories, it failed to include the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker with administrative privileges can update the 'storage_folder' to point to this session directory and then use the '/files/get/' endpoint to download session files of other users. This results in session hijacking and full account takeover. The vulnerability is rooted in CWE-706 (Use of Incorrectly-Resolved Name or Reference) within 'src/pyload/core/api/__init__.py'.

Affected products

pyLoad pyload-ng <= 0.5.0b3.dev99

Identifiers

CVE-2026-45306
GHSA-w727-595x-pc3r
PYSEC-2026-2998

Timeline

2026-05-08: disclosed: Initial disclosure by GammaC0de
2026-05-14: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.