CVSS 3.1
2.3 lowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NCVE-2024-47821
Low (2.3) in pyload pyload. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in pyload-ng 0.5.0b3.dev87.
pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved in versions prior to 0.5.0b3.dev87. A file can be downloaded to such a folder by changing the download folder to a folder in `/scripts` path and using the `/flashgot` API to download the file. This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system. Version 0.5.0b3.dev87 fixes this issue.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pyload:pyload
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w7hq-f2pj-c53g | PyPI | pyload-ng | <0.5.0b3.dev87 | 0.5.0b3.dev87 |
| PYSEC-2024-302 | PyPI | pyload-ng | <=0.5.0 | no fix published |