CVE-2026-45306 pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory
An authenticated attacker can bypass storage folder restrictions to access other users' session files, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45306?
CVE-2026-45306 is a medium-severity path traversal vulnerability in pyload, published on 28 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover. This vulnerability is fixed in 0.5.0b3.dev100.
Weakness: CWE-706
Which versions are affected by CVE-2026-45306?
3 open source packages ship an affected version, including pyload-ng.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions to 0.5.0b3.dev99 | None |
pyload-ng PyPI | All versions to 0.5.0b3.dev99 | None |
pyload-ng PyPI | All versions to 0.5.0b3.dev99 | None |
How do I fix CVE-2026-45306?
No fix has been published for CVE-2026-45306 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-45306 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45306 exists.
Sources
Also known as GHSA-w727-595x-pc3r, PYSEC-2026-2998.