Vulnerability Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() uses incorrect option names ssl_cert and ssl_key, while the actual configuration option names are ssl_certfile and ssl_keyfile. This name mismatch causes the admin-only check to always evaluate to False, allowing any user with SETTINGS permission to overwrite the SSL certificate and key file paths. Additionally, the ssl_certchain option was never added to the admin-only set at all. This vulnerability is fixed in 0.5.0b3.dev97.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pyload-Ng Project | Pyload-Ng | <= 0.5.0b3.dev96 |
Related Weaknesses (CWE)
References
- https://github.com/pyload/pyload/security/advisories/GHSA-ppvx-rwh9-7rj7ExploitVendor Advisory
FAQ
What is CVE-2026-35586?
CVE-2026-35586 is a vulnerability with a CVSS score of 6.8 (MEDIUM). pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() uses incorrect option names ssl_cert an...
How severe is CVE-2026-35586?
CVE-2026-35586 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-35586?
Check the references section above for vendor advisories and patch information. Affected products include: Pyload-Ng Project Pyload-Ng.