PT-2026-30896 · Pyload · Pyload

Offset · Published 2026-04-07 · Updated 2026-05-15 · CVE-2026-35586

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev97

Description pyLoad, a download manager written in Python, had an authorization issue in the set config value() function. The ADMIN ONLY CORE OPTIONS check used incorrect option names (ssl cert and ssl key) instead of the actual configuration option names (ssl certfile and ssl keyfile). This mismatch allowed users with SETTINGS permission to overwrite the SSL certificate and key file paths, bypassing the intended admin-only restriction. The ssl certchain option was also not included in the admin-only check.

Recommendations Update to version 0.5.0b3.dev97 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-35586

GHSA-PPVX-RWH9-7RJ7

PYSEC-2026-123

Affected Products

Pyload

References · 11

• https://github.com/pyload/pyload/security/advisories/GHSA-ppvx-rwh9-7rj7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ppvx-rwh9-7rj7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35586 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-123 · Vendor Advisory
• https://github.com/pyload/pyload · Note
• https://twitter.com/infoflowcloud/status/2041570742718849275 · Twitter Post
• https://t.me/cveNotify/163346 · Telegram Post
• https://t.me/cveNotify/163618 · Telegram Post
• https://twitter.com/dailycve/status/2051465072778662201 · Twitter Post
• https://twitter.com/CVEnew/status/2041569998121144657 · Twitter Post
• https://t.me/cveNotify/163628 · Telegram Post