CVE-2024-32880

pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication.

• CWE-434

• https://github.com/pyload/pyload/security/advisories/GHSA-3f7w-p8vr-4v5fExploit, Vendor Advisory
• https://github.com/pyload/pyload/security/advisories/GHSA-3f7w-p8vr-4v5fExploit, Vendor Advisory

Published

Apr 26, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32875Hugo is a static site generator. Starting in version 0.123.0…6.1
• CVE-2024-32876NewPipe is an Android app for video streaming written in Jav…8.5
• CVE-2024-32877Yii 2 is a PHP application framework. During internal penetr…4.7
• CVE-2024-32878Llama.cpp is LLM inference in C/C++. There is a use of unini…8.8
• CVE-2024-32879Python Social Auth is a social authentication/registration m…4.9
• CVE-2024-3288The Logo Slider WordPress plugin before 4.0.0 does not vali…5.4
• CVE-2024-32881Danswer is the AI Assistant connected to company's docs, app…9.8
• CVE-2024-32882Wagtail is an open source content management system built on…2.7
• CVE-2024-32883MCUboot is a secure bootloader for 32-bits microcontrollers.…7.7
• CVE-2024-32884gitoxide is a pure Rust implementation of Git. `gix-transpor…6.4
• CVE-2024-32886Vitess is a database clustering system for horizontal scalin…4.9
• CVE-2024-32887Sidekiq is simple, efficient background processing for Ruby.…5.5