CVE-2026-35463: RCE in pyLoad Download Manager

The vulnerability allows a user with only SETTINGS permission to execute arbitrary code on the system running pyLoad. Specifically, the AntiVirus plugin stores a path to an executable (avfile) within its configuration. This path is then directly passed to subprocess.Popen(). An attacker can modify this path to point to a malicious executable, effectively gaining remote code execution. The blast radius extends to the entire system, as the attacker can execute commands with the privileges of the pyLoad process. This could lead to data theft, system compromise, and potentially, lateral movement within the network if the pyLoad process has elevated privileges.

1. Reserved2026-04-02
2. Published2026-04-07
3. Modified2026-04-08
4. EPSS updated2026-04-15

The primary mitigation is to upgrade to a patched version of pyLoad as soon as it becomes available. Until a patch is released, consider restricting user permissions to prevent users from modifying plugin configurations. While a direct workaround is unavailable, implementing strict file system access controls can limit the attacker's ability to place malicious executables in locations accessible to the pyLoad process. Monitor the AntiVirus plugin's configuration file for unauthorized changes. After upgrading, verify the integrity of the AntiVirus plugin configuration and confirm that the executable path is set to a trusted location.