CVE-2026-35463: pyLoad Download Manager RCE Vulnerability

CVE-2026-35463 Overview

A command injection vulnerability exists in pyLoad, a free and open-source download manager written in Python. The vulnerability stems from an incomplete protection mechanism in the ADMIN_ONLY_OPTIONS configuration handling. While security-critical configuration values (reconnect scripts, SSL certificates, proxy credentials) are properly restricted to admin-only access for core configuration options, this protection is not applied to plugin configuration options. The AntiVirus plugin stores an executable path (avfile) in its configuration, which is passed directly to subprocess.Popen(). A non-admin user with SETTINGS permission can modify this path to achieve remote code execution on the server.

Critical Impact

Authenticated users with limited SETTINGS permission can escalate privileges and execute arbitrary commands on the pyLoad server, potentially leading to complete system compromise.

Affected Products

• pyLoad version 0.5.0b3.dev96 and earlier
• All pyLoad installations with the AntiVirus plugin enabled
• Systems where non-admin users have SETTINGS permission

Discovery Timeline

• 2026-04-07 - CVE-2026-35463 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-35463

Vulnerability Analysis

This vulnerability represents a classic privilege escalation through incomplete access control implementation (CWE-78: Improper Neutralization of Special Elements used in an OS Command). The pyLoad application implements an ADMIN_ONLY_OPTIONS protection mechanism designed to prevent non-admin users from modifying sensitive configuration settings that could impact system security. However, this protection was only implemented for core configuration options, leaving plugin configurations unprotected.

The AntiVirus plugin configuration includes an avfile parameter that specifies the path to an antivirus executable. When a file download completes, pyLoad invokes this executable via Python's subprocess.Popen() function to scan the downloaded file. Since the avfile path is user-controlled and lacks proper validation, an attacker with SETTINGS permission can replace it with an arbitrary command or malicious script path.

The attack requires network access and authenticated access with SETTINGS permission, but does not require admin privileges. Successful exploitation enables an attacker to execute arbitrary commands with the privileges of the pyLoad service account, potentially compromising confidentiality, integrity, and availability of the underlying system.

Root Cause

The root cause is an inconsistent application of the ADMIN_ONLY_OPTIONS security mechanism. While the protection was correctly implemented for core pyLoad configuration options, it was not extended to plugin configuration options. This oversight allows non-admin users to modify sensitive plugin settings, including executable paths that are subsequently passed to system command execution functions without proper sanitization.

The vulnerable code path directly passes user-controlled input to subprocess.Popen() without validating that the path points to a legitimate antivirus executable or sanitizing the input for shell metacharacters.

Attack Vector

The attack vector is network-based, requiring the attacker to authenticate to the pyLoad web interface with a user account that has SETTINGS permission. The exploitation flow involves:

1. Authentication: Attacker logs into pyLoad with a non-admin account that has SETTINGS permission
2. Configuration Modification: Attacker navigates to the AntiVirus plugin settings and modifies the avfile parameter to point to a malicious executable or shell command
3. Trigger Execution: When a file download completes and triggers antivirus scanning, pyLoad executes the attacker-specified command via subprocess.Popen()
4. Code Execution: The malicious command executes with the privileges of the pyLoad service account

The vulnerability requires low attack complexity since no special conditions or timing requirements exist beyond having valid credentials with appropriate permissions. For technical details and the security patch, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35463

Indicators of Compromise

• Unexpected modifications to the AntiVirus plugin configuration, particularly the avfile setting
• Configuration changes made by non-admin user accounts to plugin settings
• Unusual process spawning from the pyLoad service process
• Unexpected outbound network connections or reverse shell activity from the pyLoad server

Detection Strategies

• Monitor pyLoad configuration files for unauthorized changes to plugin settings
• Implement file integrity monitoring on pyLoad configuration directories
• Review pyLoad access logs for configuration modification attempts by non-admin users
• Deploy endpoint detection to identify suspicious process chains originating from Python/pyLoad processes

Monitoring Recommendations

• Enable detailed audit logging for all configuration changes within pyLoad
• Configure alerting for any modifications to the AntiVirus plugin avfile setting
• Monitor system process execution for unusual commands spawned by the pyLoad service account
• Implement network monitoring for suspicious outbound connections from the pyLoad server

How to Mitigate CVE-2026-35463

Immediate Actions Required

• Update pyLoad to a patched version that extends ADMIN_ONLY_OPTIONS protection to plugin configurations
• Review all user accounts with SETTINGS permission and revoke unnecessary privileges
• Audit AntiVirus plugin configuration for any unauthorized modifications to the avfile setting
• Consider disabling the AntiVirus plugin until a patched version is deployed

Patch Information

A security patch has been released to address this vulnerability. The fix extends the ADMIN_ONLY_OPTIONS protection mechanism to cover plugin configuration options, preventing non-admin users from modifying sensitive plugin settings.

For patch details, see the GitHub commit. Additional security advisory information is available at the GitHub Security Advisory.

Workarounds

• Restrict SETTINGS permission to trusted admin users only until patching is complete
• Disable the AntiVirus plugin if not required for your deployment
• Implement network segmentation to limit lateral movement if the pyLoad server is compromised
• Run pyLoad with minimal system privileges using a dedicated service account with restricted permissions

# Temporary workaround: Restrict pyLoad configuration file permissions
chmod 600 /path/to/pyload/config/plugins.conf
chown pyload:pyload /path/to/pyload/config/plugins.conf

# Review users with SETTINGS permission in pyLoad user database
# Revoke SETTINGS permission for non-admin users until patched