CVE-2026-33509: Pyload Download Manager RCE Vulnerability

CVE-2026-33509 Overview

pyLoad is a free and open-source download manager written in Python. A privilege escalation vulnerability exists in pyLoad versions 0.4.0 to before 0.5.0b3.dev97 that allows users with the non-admin SETTINGS permission to achieve Remote Code Execution (RCE) through the set_config_value() API endpoint. This vulnerability stems from improper access control that permits modification of security-critical configuration options, specifically the reconnect.script parameter, which is passed directly to subprocess.run().

Critical Impact

Attackers with low-privilege SETTINGS access can achieve full system compromise by executing arbitrary commands through the misconfigured reconnect script functionality.

Affected Products

• pyLoad versions 0.4.0 to before 0.5.0b3.dev97
• pyload-ng (Python package) affected versions

Discovery Timeline

• 2026-03-24 - CVE-2026-33509 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33509

Vulnerability Analysis

This vulnerability represents a critical privilege escalation flaw in pyLoad's configuration management system. The set_config_value() API endpoint is designed to allow users to modify various application settings, but it fails to properly restrict which settings can be modified based on user privilege levels. Users with the SETTINGS permission—which is intended to be a limited, non-administrative role—can modify any configuration option without proper authorization checks.

The core issue lies in the minimal input validation implemented within set_config_value(). The only hardcoded security check in place validates modifications to general.storage_folder, leaving all other security-critical settings completely unprotected. This includes the dangerous reconnect.script configuration option, which specifies a file path that gets passed directly to Python's subprocess.run() function within the thread manager's reconnect logic.

Root Cause

The root cause is an improper privilege separation vulnerability (CWE-269: Improper Privilege Management). The application fails to implement an allowlist or path restrictions for security-critical configuration options. The set_config_value() function only validates one specific setting (general.storage_folder) while leaving other equally dangerous settings like reconnect.script completely writable by any user with SETTINGS permissions. This design flaw creates a direct path from a limited user role to arbitrary code execution.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker who has obtained valid credentials with the SETTINGS permission can exploit this vulnerability remotely without any user interaction. The attack flow involves:

1. Authenticating to pyLoad with a user account that has SETTINGS permission
2. Calling the set_config_value() API endpoint to modify reconnect.script to point to a malicious executable or script on the system
3. Triggering the reconnect functionality, which causes subprocess.run() to execute the attacker-controlled script path
4. Achieving arbitrary command execution with the privileges of the pyLoad process

Since the vulnerability requires only SETTINGS permission rather than full administrative access, it represents a significant privilege escalation risk in multi-user pyLoad deployments.

Detection Methods for CVE-2026-33509

Indicators of Compromise

• Unexpected modifications to the reconnect.script configuration value in pyLoad settings
• API calls to set_config_value() targeting the reconnect.script parameter from non-admin users
• Unusual process spawning from the pyLoad application, particularly unexpected child processes
• Authentication events followed by configuration change events for security-sensitive settings

Detection Strategies

• Monitor API access logs for calls to the set_config_value() endpoint, particularly those modifying reconnect.script or other critical settings
• Implement file integrity monitoring on pyLoad configuration files to detect unauthorized changes
• Review audit logs for configuration modifications by users with limited (non-admin) permissions
• Deploy endpoint detection to identify suspicious subprocess execution originating from the pyLoad process

Monitoring Recommendations

• Enable verbose logging for the pyLoad application to capture all configuration change events
• Establish baseline configuration values and alert on deviations, especially for executable paths
• Monitor network traffic for unusual API patterns suggesting automated exploitation attempts
• Implement process tree monitoring to detect unexpected child processes spawned by pyLoad

How to Mitigate CVE-2026-33509

Immediate Actions Required

• Upgrade pyLoad to version 0.5.0b3.dev97 or later immediately
• Audit all user accounts with SETTINGS permissions and revoke unnecessary access
• Review current configuration values, particularly reconnect.script, for any unauthorized modifications
• Restrict network access to pyLoad instances to trusted networks only until patched

Patch Information

The vulnerability has been patched in pyLoad version 0.5.0b3.dev97. The fix implements proper access controls for security-critical configuration options, preventing non-admin users from modifying dangerous settings like reconnect.script. Users should upgrade immediately by following the official upgrade procedures.

For detailed patch information and security advisory, see the GitHub Security Advisory.

Workarounds

• Restrict the SETTINGS permission to only trusted administrator accounts until the patch can be applied
• Implement network-level access controls (firewall rules) to limit API access to the pyLoad instance
• Monitor and lock down the reconnect.script configuration at the file system level to prevent modifications
• Consider disabling the reconnect functionality entirely if not required for your use case

# Example: Restrict pyLoad access to localhost only using iptables
iptables -A INPUT -p tcp --dport 8000 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP