# CVE-2026-45306: pyLoad account takeover via session directory bypass in storage_folder

Source: https://junglewise.ai/threats/cve-2026-45306-pyload-account-takeover-via-session-directory-bypass-in-storage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-45306 · Severity: medium · CVSS 6.5 · Published 2026-05-28

pyLoad, a popular download manager, contains a flaw where an administrator can bypass security restrictions to access sensitive session files. By changing the application's storage folder to the internal session directory, an attacker can steal login tokens of other users. This allows the attacker to take over other user accounts and gain unauthorized access to the system.

Technologies: [pyLoad Next Generation](https://junglewise.ai/threats/technologies/pyload-next-generation), [pyload-ng (PyPI)](https://junglewise.ai/threats/technologies/pyload-ng). Vendors: [pyLoad](https://junglewise.ai/threats/vendors/pyload), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-45306 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45306 being exploited in the wild.

**How severe is CVE-2026-45306?** Medium severity, with a CVSS score of 6.5, published 28 May 2026.

**Which products and versions are affected?** pyLoad Next Generation <= 0.5.0b3.dev99; pyload-ng (PyPI) <= 0.5.0b3.dev99, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev99.

**Is there a fix for CVE-2026-45306?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45306 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45306?** Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incomplete fix for CVE-2026-33509 in pyLoad allows a directory bypass via the 'storage_folder' configuration. While the original fix blocked setting the storage folder to the package or user directories, it failed to include the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker with administrative privileges can update the 'storage_folder' to point to this session directory and then use the '/files/get/' endpoint to download session files of other users. This results in session hijacking and full account takeover. The vulnerability is rooted in CWE-706 (Use of Incorrectly-Resolved Name or Reference) within 'src/pyload/core/api/__init__.py'.

## Affected products

- pyLoad pyload-ng <= 0.5.0b3.dev99

## Identifiers

- CVE-2026-45306
- GHSA-w727-595x-pc3r
- PYSEC-2026-2998

## Timeline

- 2026-05-08: disclosed: Initial disclosure by GammaC0de
- 2026-05-14: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/NSSYS](https://api.github.com/users/NSSYS)
- [https://github.com/NSSYS](https://github.com/NSSYS)
- [https://api.github.com/users/NSSYS/gists%7B/gist_id%7D](https://api.github.com/users/NSSYS/gists%7B/gist_id%7D)
- [https://api.github.com/users/NSSYS/repos](https://api.github.com/users/NSSYS/repos)
- [https://avatars.githubusercontent.com/u/29173071?v=4](https://avatars.githubusercontent.com/u/29173071?v=4)
- [https://api.github.com/users/NSSYS/events%7B/privacy%7D](https://api.github.com/users/NSSYS/events%7B/privacy%7D)

## Related threats

- [pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses)
- [pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service)
- [pyload-ng authentication bypass in getUserData/get_userdata](https://junglewise.ai/threats/pyload-ng-getuserdata-get-userdata-exposed-at-perms-any-allow-any-cd197c9d)
- [pyLoad rate-limit bypass and audit-log spoofing via X-Forwarded-For header](https://junglewise.ai/threats/pyload-rate-limit-bypass-and-audit-log-spoofing-via-trusted-client-0df0fd12)
- [pyLoad session invalidation bypass in privilege revocation and password change](https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba)