PT-2026-30340 · Pyload · Anti-Virus+1

Axel-Corsiez

·

Published

2026-04-04

·

Updated

2026-05-15

·

CVE-2026-35463

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions pyLoad (affected versions not specified)
Description The ADMIN ONLY OPTIONS protection mechanism, intended to restrict access to sensitive configuration values, is not applied to plugin configuration options. Specifically, the AntiVirus plugin stores an executable path (avfile) in its configuration, which is then directly passed to subprocess.Popen(). A non-admin user with SETTINGS permission can modify this path to execute arbitrary code. The vulnerability also allows for arbitrary file read through manipulation of the storage folder configuration option. An attacker can set storage folder to '/' and then access files like /etc/passwd via the /files/get/ API endpoint. This results in remote code execution, potential privilege escalation, and arbitrary file read.
API Endpoints: /api/set config value, /api/add package, /files/get/ Vulnerable Parameters or Variables: avfile, avargs, storage folder, section, option, value Vulnerable Functions: scan file(), set config value()
Recommendations Apply ADMIN ONLY OPTIONS to plugin configurations. Specifically, add plugin options that control executables or paths, such as AntiVirus.avfile and AntiVirus.avargs, to the ADMIN ONLY PLUGIN OPTIONS set within the set config value() function. Alternatively, validate that the avfile parameter points to a known and trusted antivirus binary before passing it to subprocess.Popen().

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-35463
GHSA-W48F-WWWF-F5FR

Affected Products

Anti-Virus
Pyload