p PatchFirst

CVE-2026-45306

CVE-2026-45306 · pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover. This vulnerability is fixed in 0.5.0b3.dev100.

CVSS 6.5 · Medium · EPSS 0.4%

Published
Updated

Stack: python

Affected products and versions

  • pyload

    Versions
    • < 0.5.0b3.dev100: Affected

    No fix published

  • pyload-ng PyPI

    Versions
    • 0.5.0a5.dev528
    • 0.5.0a5.dev532
    • 0.5.0a5.dev535
    • 0.5.0a5.dev536
    • 0.5.0a5.dev537
    • 0.5.0a5.dev539
    • 0.5.0a5.dev540
    • 0.5.0a5.dev545
    • 0.5.0a5.dev562
    • 0.5.0a5.dev564
    • 0.5.0a5.dev565
    • 0.5.0a6.dev570
    • 0.5.0a6.dev578
    • 0.5.0a6.dev587
    • 0.5.0a7.dev596
    • 0.5.0a8.dev602
    • 0.5.0a9.dev615
    • 0.5.0a9.dev629
    • 0.5.0a9.dev632
    • 0.5.0a9.dev641
    • 0.5.0a9.dev643
    • 0.5.0a9.dev655
    • 0.5.0a9.dev806
    • 0.5.0b1.dev1
    • 0.5.0b1.dev2
    • 0.5.0b1.dev3
    • 0.5.0b1.dev4
    • 0.5.0b1.dev5
    • 0.5.0b2.dev10
    • 0.5.0b2.dev11
    • 0.5.0b2.dev12
    • 0.5.0b2.dev9
    • 0.5.0b3.dev13
    • 0.5.0b3.dev14
    • 0.5.0b3.dev17
    • 0.5.0b3.dev18
    • 0.5.0b3.dev19
    • 0.5.0b3.dev20
    • 0.5.0b3.dev21
    • 0.5.0b3.dev22
    • 0.5.0b3.dev24
    • 0.5.0b3.dev26
    • 0.5.0b3.dev27
    • 0.5.0b3.dev28
    • 0.5.0b3.dev29
    • 0.5.0b3.dev30
    • 0.5.0b3.dev31
    • 0.5.0b3.dev32
    • 0.5.0b3.dev33
    • 0.5.0b3.dev34
    • 0.5.0b3.dev35
    • 0.5.0b3.dev38
    • 0.5.0b3.dev39
    • 0.5.0b3.dev40
    • 0.5.0b3.dev41
    • 0.5.0b3.dev42
    • 0.5.0b3.dev43
    • 0.5.0b3.dev44
    • 0.5.0b3.dev45
    • 0.5.0b3.dev46
    • 0.5.0b3.dev47
    • 0.5.0b3.dev48
    • 0.5.0b3.dev49
    • 0.5.0b3.dev50
    • 0.5.0b3.dev51
    • 0.5.0b3.dev52
    • 0.5.0b3.dev53
    • 0.5.0b3.dev54
    • 0.5.0b3.dev57
    • 0.5.0b3.dev60
    • 0.5.0b3.dev62
    • 0.5.0b3.dev64
    • 0.5.0b3.dev65
    • 0.5.0b3.dev66
    • 0.5.0b3.dev67
    • 0.5.0b3.dev68
    • 0.5.0b3.dev69
    • 0.5.0b3.dev70
    • 0.5.0b3.dev71
    • 0.5.0b3.dev72
    • 0.5.0b3.dev73
    • 0.5.0b3.dev74
    • 0.5.0b3.dev75
    • 0.5.0b3.dev76
    • 0.5.0b3.dev77
    • 0.5.0b3.dev78
    • 0.5.0b3.dev79
    • 0.5.0b3.dev80
    • 0.5.0b3.dev81
    • 0.5.0b3.dev82
    • 0.5.0b3.dev85
    • 0.5.0b3.dev87
    • 0.5.0b3.dev88
    • 0.5.0b3.dev89
    • 0.5.0b3.dev90
    • 0.5.0b3.dev91
    • 0.5.0b3.dev92
    • 0.5.0b3.dev93
    • 0.5.0b3.dev94
    • 0.5.0b3.dev95
    • 0.5.0b3.dev96
    • 0.5.0b3.dev97
    • 0.5.0b3.dev98
    • 0.5.0b3.dev99
    Affected ranges
    • ECOSYSTEM: ≤ 0.5.0b3.dev99

    No fix published

Original sources

Check your server →