GHSA-w727-595x-pc3r

Опубликовано: 14 мая 2026

Источник: github

Github: Прошло ревью

CVSS3: 6.5

Описание

pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad

Summary

The fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover.

Details

The fix in src/pyload/core/api/__init__.py:

directories = [PKGDIR, userdir] if any(directories[0].startswith(d) for d in directories[1:]): return # blocked

But the Flask session directory is:

session_storage_path = os.path.join(api.get_cachedir(), "flask") # = /tmp/pyLoad/flask ← NOT blocked by fix

Attack Chain

Attacker (admin) sets storage_folder = /tmp/pyLoad/flask
Fix does NOT block this — /tmp/pyLoad/flask not inside PKGDIR or userdir
Attacker requests GET /files/get/<victim_session_filename>
send_from_directory('/tmp/pyLoad/flask', session_file) serves victim's session
Attacker uses stolen session → Account Takeover

PoC

import os PKGDIR = "/usr/lib/python3/dist-packages/pyload" userdir = os.path.expanduser("~/.pyload") session_dir = "/tmp/pyLoad/flask" correct_case = lambda x: x directories = [ correct_case(os.path.join(os.path.realpath(d), "")) for d in [session_dir, PKGDIR, userdir] ] blocked = any(directories[0].startswith(d) for d in directories[1:]) print(f"Fix blocks session_dir: {blocked}") # Output: Fix blocks session_dir: False ← BYPASS CONFIRMED

Impact

Authenticated admin can steal sessions of other users → Account Takeover.

Suggested Fix

blocked_dirs = [PKGDIR, userdir, api.get_cachedir()] directories = [ os.path.join(os.path.realpath(d), "") for d in [value] + blocked_dirs ] if any(directories[0].startswith(d) for d in directories[1:]): return

Ссылки

Пакеты

Наименование

pyload-ng

pip

Затронутые версииВерсия исправления

<= 0.5.0b3.dev99

Отсутствует

EPSS

Процентиль: 14%

0.00234

Низкий

6.5 Medium

CVSS3

CVE ID

CVE-2026-45306

Дефекты

CWE-706

Связанные уязвимости

CVE-2026-45306

CVSS3: 6.5

nvd

3 месяца назад

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover. This vulnerability is fixed in 0.5.0b3.dev100.

CVE-2026-45306

CVSS3: 6.5

debian

3 месяца назад

pyLoad is a free and open-source download manager written in Python. P ...

EPSS

Процентиль: 14%

0.00234

Низкий

6.5 Medium

CVSS3

CVE ID

CVE-2026-45306

Дефекты

CWE-706