CVE-2024-47821 pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API
An attacker with settings access can execute arbitrary code by downloading scripts to the scripts folder via the flashgot API.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47821?
CVE-2024-47821 is a critical code injection vulnerability in pyload, published on 25 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved in versions prior to 0.5.0b3.dev87. A file can be downloaded to such a folder by changing the download folder to a folder in `/scripts` path and using the `/flashgot` API to download the file. This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system. Version 0.5.0b3.dev87 fixes this issue.
Weakness: CWE-78
Which versions are affected by CVE-2024-47821?
3 open source packages ship an affected version, including pyload-ng. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions to 0.5.0 | None |
pyload-ng PyPI | All versions | 0.5.0b3.dev87 |
pyload-ng PyPI | All versions | 0.5.0b3.dev87 |
Products include Pyload Pyload.
How do I fix CVE-2024-47821?
Upgrade pyload-ng to 0.5.0b3.dev87 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-47821 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47821 exists.
Other vulnerabilities in pyload
- CVE-2023-0297 Code Injection in pyload/pyload
- CVE-2026-33992 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
- CVE-2024-32880 pyLoad allows upload to arbitrary folder lead to RCE
- CVE-2026-41133 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
- CVE-2023-47890 Download to arbitrary folder can lead to RCE
Sources
Also known as GHSA-w7hq-f2pj-c53g, PYSEC-2024-302.