https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:31:27 +0000 https://cve.radiocsirt.org/vuln/cve-2026-45306 <p><strong>Affected:</strong> pyload</p> <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover. This vulnerability is fixed in 0.5.0b3.dev100.</p> <p><strong>Affected:</strong> pyload</p> <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover. This vulnerability is fixed in 0.5.0b3.dev100.</p> https://cve.radiocsirt.org/vuln/cve-2026-45306 https://cve.radiocsirt.org/vuln/ghsa-w727-595x-pc3r <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>## Summary The fix for CVE-2026-33509 prevents setting `storage_folder` inside `PKGDIR` or `userdir`, but does NOT protect the Flask session directory (`/tmp/pyLoad/flask`). An authenticated attacker can set `storage_folder` to the session directory and download session files of other users via `/files/get/`, leading to account takeover.</p> <p>## Details</p> <p>The fix in `src/pyload/core/api/__init__.py`:</p> <p>```python directories = [PKGDIR, userdir] if any(directories[0].startswith(d) for d in directories[1:]): return # blocked ```</p> <p>But the Flask session directory is: ```python session_storage_path = os.path.join(api.get_cachedir(), &#34;flask&#34;) # = /tmp/pyLoad/flask ← NOT blocked by fix ```</p> <p>## Attack Chain</p> <p>1. Attacker (admin) sets `storage_folder = /tmp/pyLoad/flask` 2. Fix does NOT block this — `/tmp/pyLoad/flask` not inside `PKGDIR` or `userdir` 3. Attacker requests `GET /files/get/&lt;victim_session_filename&gt;` 4. `send_from_directory(&#39;/tmp/pyLoad/flask&#39;, session_file)` serves victim&#39;s session 5. Attacker uses stolen session → **Account Takeover**</p> <p>## PoC</p> <p>&lt;img width=&#34;592&#34; height=&#34;408&#34; alt=&#34;POC&#34; src=&#34;https://github.com/user-attachments/assets/936b9f56-325b-437d-9edd-e0d5bb995187&#34; /&gt;</p> <p>```python import os</p> <p>PKGDIR = &#34;/usr/lib/python3/dist-packages/pyload&#34; userdir = os.path.expanduser(&#34;~/.pyload&#34;) session_dir = &#34;/tmp/pyLoad/flask&#34;</p> <p>correct_case = lambda x: x directories = [ correct_case(os.path.join(os.path.realpath(d), &#34;&#34;)) for d in [session_dir, PKGDIR, userdir] ] blocked = an…</p> <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>## Summary The fix for CVE-2026-33509 prevents setting `storage_folder` inside `PKGDIR` or `userdir`, but does NOT protect the Flask session directory (`/tmp/pyLoad/flask`). An authenticated attacker can set `storage_folder` to the session directory and download session files of other users via `/files/get/`, leading to account takeover.</p> <p>## Details</p> <p>The fix in `src/pyload/core/api/__init__.py`:</p> <p>```python directories = [PKGDIR, userdir] if any(directories[0].startswith(d) for d in directories[1:]): return # blocked ```</p> <p>But the Flask session directory is: ```python session_storage_path = os.path.join(api.get_cachedir(), &#34;flask&#34;) # = /tmp/pyLoad/flask ← NOT blocked by fix ```</p> <p>## Attack Chain</p> <p>1. Attacker (admin) sets `storage_folder = /tmp/pyLoad/flask` 2. Fix does NOT block this — `/tmp/pyLoad/flask` not inside `PKGDIR` or `userdir` 3. Attacker requests `GET /files/get/&lt;victim_session_filename&gt;` 4. `send_from_directory(&#39;/tmp/pyLoad/flask&#39;, session_file)` serves victim&#39;s session 5. Attacker uses stolen session → **Account Takeover**</p> <p>## PoC</p> <p>&lt;img width=&#34;592&#34; height=&#34;408&#34; alt=&#34;POC&#34; src=&#34;https://github.com/user-attachments/assets/936b9f56-325b-437d-9edd-e0d5bb995187&#34; /&gt;</p> <p>```python import os</p> <p>PKGDIR = &#34;/usr/lib/python3/dist-packages/pyload&#34; userdir = os.path.expanduser(&#34;~/.pyload&#34;) session_dir = &#34;/tmp/pyLoad/flask&#34;</p> <p>correct_case = lambda x: x directories = [ correct_case(os.path.join(os.path.realpath(d), &#34;&#34;)) for d in [session_dir, PKGDIR, userdir] ] blocked = an…</p> https://cve.radiocsirt.org/vuln/ghsa-w727-595x-pc3r