CVE-2026-35463

Katalog CVE

CVSS 8.8 · High EPSS 0,91%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada pyload-ng project pyload-ng. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts security-critical configuration values (reconnect scripts, SSL certs, proxy credentials) to admin-only access. However, this protection is only applied to core config options, not to plugin config options. The AntiVirus plugin stores an executable path (avfile) in its config, which is passed directly to subprocess.Popen(). A non-admin user with SETTINGS permission can change this path to achieve remote code execution.

Rincian

Terbit di NVD

7 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pyload/pyload/security/advisories/GHSA-w48f-wwwf-f5fr exploit · mitigasi · advisory vendor
• https://github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1 patch