CVE-2026-45306 json
pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory
published 5mo ago modified 3mo ago also EUVD-2026-32958 , GHSA-w727-595x-pc3r , PYSEC-2026-2998
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover. This vulnerability is fixed in 0.5.0b3.dev100.
Patch / fix
- pyload-ng_project pyload-ng 0.5.0b3.dev100
- pyload pyload 0.5.0b3.dev100
Is CVE-2026-45306 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5mo ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/pyload/pyload/security/advisories/GHSA-w727-595x-pc3r referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pyload-ng | <=0.5.0b3.dev99 |
no fix listed |
Affected products
- pyload pyload
Classification
- Weakness
-
- CWE-706 Use of Incorrectly-Resolved Name or Reference
References
-
github.com
/pyload/pyload/security/advisories/GHSA-w727-595x-pc3r
exploit, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-45306
advisory
-
github.com
/advisories/GHSA-r7mc-x6x7-cqxx
advisory
-
github.com
/pyload/pyload
package
-
pypi.org
/project/pyload-ng
package
-
github.com
/advisories/GHSA-w727-595x-pc3r
advisory
Sources
- CVE List CVE-2026-45306
- GitHub Advisory GHSA-w727-595x-pc3r
- NVD CVE-2026-45306
- OSV PYSEC-2026-2998
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.