CVE-2026-35464

CVE-2026-35464 is a privilege escalation vulnerability in pyLoad, an open-source Python download manager, that allows authenticated users with SETTINGS and ADD permissions to achieve arbitrary code execution. The vulnerability exploits a gap in the security controls implemented to fix a previous vulnerability, specifically the failure to restrict the storage_folder configuration option that can be manipulated to redirect downloads to the Flask session directory. The attack has a HIGH severity rating with CVSS 3.1 score of 7.5, requiring network access and low-level user privileges but achievable with relatively low complexity. An attacker with the noted permissions can plant a malicious pickle payload as a predictable session file and trigger code execution when a corresponding session cookie is presented, resulting in high impact to confidentiality, integrity, and availability. There is currently no indication of active exploitation in the wild. The vulnerability has not been added to the KEV Catalog or designated as a priority on vulnerability hot lists, and the EPSS score of 0.0009 indicates minimal real-world exploitation activity relative to other known vulnerabilities. The issue has been patched via commit c4cf995a2803bdbe388addfc2b0f323277efc0e1, and organizations running pyLoad should prioritize updating to the patched version.