{"id":"CVE-2026-45306","published":"2026-05-28T17:12:59Z","modified":"2026-05-28T18:49:45Z","title":"pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory","vendor":"pyload","product":"pyload","tier":"tail","description":{"text":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover. This vulnerability is fixed in 0.5.0b3.dev100.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00234,"percentile":0.1435,"provenance":"source"},"cwes":[{"id":"CWE-706","name":"Use of Incorrectly-Resolved Name or Reference"}],"references":[{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-w727-595x-pc3r","tags":["x_refsource_CONFIRM"]}],"priority":{"score":7.4,"factors":[{"name":"EPSS percentile","points":2.87},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"pyload","affectedVersions":[{"vendor":"pyload","product":"pyload","versions":["< 0.5.0b3.dev100"]}],"affected":[{"ecosystem":"PyPI","package":"pyload-ng","vulnerableRanges":["<=0.5.0b3.dev99"],"patched":[],"from":["GHSA-w727-595x-pc3r","PYSEC-2026-2998"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-32958","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pyload-cve-2026-33509","parents":[{"from":"CVE-2026-33509","to":"CVE-2026-45306","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask).","from":"CVE.org","in":"CVE-2026-45306"},{"kind":"osv-related","provenance":"source","id":"GHSA-w727-595x-pc3r","via":"reference","url":"https://github.com/advisories/GHSA-r7mc-x6x7-cqxx"},{"kind":"osv-related","provenance":"source","id":"PYSEC-2026-2998","via":"reference","url":"https://github.com/advisories/GHSA-r7mc-x6x7-cqxx"}]}]}}