CVE-2026-35463 pyLoad has Improper Neutralization of Special Elements used in an OS Command
A non-admin user can achieve remote code execution by modifying the AntiVirus plugin's executable path due to missing admin-only restrictions on plugin configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35463?
CVE-2026-35463 is a high-severity command injection vulnerability in pyload, published on 7 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts security-critical configuration values (reconnect scripts, SSL certs, proxy credentials) to admin-only access. However, this protection is only applied to core config options, not to plugin config options. The AntiVirus plugin stores an executable path (avfile) in its config, which is passed directly to subprocess.Popen(). A non-admin user with SETTINGS permission can change this path to achieve remote code execution.
Weakness: CWE-78
Which versions are affected by CVE-2026-35463?
3 open source packages ship an affected version, including pyload-ng. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions to 0.5.0b3.dev96 | None |
pyload-ng PyPI | All versions to 0.5.0b3.dev96 | None |
pyload-ng PyPI | All versions | 0.5.0b3.dev97 |
Products include Pyload-Ng Project Pyload-Ng.
How do I fix CVE-2026-35463?
Upgrade pyload-ng to 0.5.0b3.dev97 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-35463 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35463 exists.
Other vulnerabilities in pyload
- CVE-2025-54802 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)
- CVE-2024-22416 Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
- CVE-2023-0488 Cross-site Scripting (XSS) - Stored in pyload/pyload
- CVE-2026-35459 pyLoad has SSRF fix bypass via HTTP redirect
- CVE-2026-33511 pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad
Sources
Also known as GHSA-w48f-wwwf-f5fr, PYSEC-2026-2267.