pyLoad SETTINGS 权限用户可以通过不受限制的Reconnect脚本配置实现远程代码执行

The impact of CVE-2026-33509 is severe. An attacker who can obtain the SETTINGS permission within pyload-ng can leverage this vulnerability to achieve full remote code execution on the affected system. This means they could install malware, steal sensitive data, modify system configurations, or even gain persistent access. The reconnect.script setting is particularly dangerous because it directly executes a user-controlled file path via subprocess.run(), bypassing typical security checks. The lack of validation beyond a hardcoded check for general.storage_folder makes almost all settings vulnerable. This vulnerability shares similarities with other configuration-based RCE exploits where user-controlled paths are passed to system commands without proper sanitization.

Organizations and individuals using pyload-ng for download management, particularly those with multiple users or shared hosting environments, are at risk. Systems where the SETTINGS permission has been granted to non-administrative users are especially vulnerable. Legacy configurations that haven't been regularly updated are also at increased risk.

• linux / server:

journalctl -u pyload-ng | grep -i "reconnect.script"

• python / supply-chain:

import os
config_path = os.path.expanduser('~/.config/pyload-ng/config.json')
with open(config_path, 'r') as f:
    config = json.load(f)
    if 'reconnect' in config and 'script' in config['reconnect']:
        print(f"Potential vulnerability: reconnect.script set to {config['reconnect']['script']}")

• generic web: Use curl or wget to check for the existence of the /api/v1/settings/setconfigvalue endpoint. Examine the response headers for any unusual or unexpected content.

1. 2026-03-20Disclosure

   disclosure

1. 已保留2026-03-20
2. 发布日期2026-03-20
3. 修改日期2026-03-27
4. EPSS 更新日期2026-04-01

The primary mitigation for CVE-2026-33509 is to upgrade pyload-ng to version 0.5.0b3.dev97 or later, which includes the fix. If upgrading is not immediately feasible, consider restricting the SETTINGS permission to trusted users only. Implement a Web Application Firewall (WAF) or proxy to filter requests to the setconfigvalue() API endpoint, specifically blocking attempts to modify the reconnect.script setting. Review all configuration options and ensure that any user-writable settings are properly validated and sanitized. After upgrading, verify the fix by attempting to modify the reconnect.script setting with a non-executable file and confirming that the operation fails with an appropriate error message.