CVE-2026-33509

pyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API endpoint allows users with the non-admin SETTINGS permission to modify any configuration option without restriction. The reconnect.script config option controls a file path that is passed directly to subprocess.run() in the thread manager's reconnect logic. A SETTINGS user can set this to any executable file on the system, achieving Remote Code Execution. The only validation in set_config_value() is a hardcoded check for general.storage_folder — all other security-critical settings including reconnect.script are writable without any allowlist or path restriction. This issue has been patched in version 0.5.0b3.dev97.

• CWE-269

• https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxxExploit, Mitigation, Vendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33503Ory Kratos is an identity, user management and authenticatio…7.2
• CVE-2026-33504Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider…7.2
• CVE-2026-33505Ory Keto is am open source authorization server for managing…7.2
• CVE-2026-33506Ory Polis, formerly known as BoxyHQ Jackson, bridges or prox…8.8
• CVE-2026-33507WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33508Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-3351Improper authorization in the API endpoint GET /1.0/certific…4.3
• CVE-2026-33510Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-b…8.8
• CVE-2026-33511pyLoad is a free and open-source download manager written in…9.8
• CVE-2026-33512WWBN AVideo is an open source video platform. In versions up…7.5
• CVE-2026-33513WWBN AVideo is an open source video platform. In versions up…7.5
• CVE-2026-33514Discourse is an open-source discussion platform. In versions…4.3