CVE-2024-47821
Description
pyLoad is a free and open-source Download Manager. The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved in versions prior to 0.5.0b3.dev87. A file can be downloaded to such a folder by changing the download folder to a folder in /scripts path and using the /flashgot API to download the file. This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system. Version 0.5.0b3.dev87 fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pyload-ngPyPI | < 0.5.0b3.dev87 | 0.5.0b3.dev87 |
Affected products
3Patches
Vulnerability mechanics
References
5- github.com/pyload/pyload/security/advisories/GHSA-w7hq-f2pj-c53gnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-w7hq-f2pj-c53gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-47821ghsaADVISORY
- github.com/pyload/pyload/commit/48f59567393a19263c8a0285256a7537dc9ce109ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2024-302.yamlghsaWEB
News mentions
0No linked articles in our index yet.