CVE-2026-45306 Details
Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover. This vulnerability is fixed in 0.5.0b3.dev100.
A vulnerability in pyLoad, a Python-based download manager, allows authenticated attackers to bypass storage folder restrictions and access other users' session files, leading to account takeover. This issue affects pyLoad versions prior to 0.5.0b3.dev100. The vulnerability arises because the fix for CVE-2026-33509 did not account for the Flask session directory, allowing attackers to manipulate session storage and steal session files through the application's file retrieval endpoint.
Users can update to pyLoad version 0.5.0b3.dev100 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pyload/pyload/security/advisories/GHSA-w727-595x-pc3r | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/pyload/pyload/security/advisories/GHSA-w727-595x-pc3r | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pyLoad | <= 0.5.0b3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |