{"id":"CVE-2024-47821","published":"2024-10-25T22:48:57Z","modified":"2024-10-28T19:41:54Z","title":"pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API","vendor":"pyload","product":"pyload","tier":"tail","description":{"text":"pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved in versions prior to 0.5.0b3.dev87. A file can be downloaded to such a folder by changing the download folder to a folder in `/scripts` path and using the `/flashgot` API to download the file. This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system. Version 0.5.0b3.dev87 fixes this issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00682,"percentile":0.52452,"provenance":"source"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-w7hq-f2pj-c53g","tags":["x_refsource_CONFIRM"]}],"priority":{"score":16.9,"factors":[{"name":"EPSS percentile","points":10.49},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"pyload","affectedVersions":[{"vendor":"pyload","product":"pyload","versions":["< 0.5.0b3.dev87"]}],"affected":[{"ecosystem":"PyPI","package":"pyload-ng","vulnerableRanges":["<0.5.0b3.dev87","<=0.5.0"],"patched":["0.5.0b3.dev87"],"from":["GHSA-w7hq-f2pj-c53g","PYSEC-2024-302"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3149","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pyload-cve-2023-0227","parents":[{"from":"CVE-2023-0227","to":"CVE-2024-47821","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/pyload/core/api/__init__.py"],"commits":["https://github.com/pyload/pyload/commit/c035714c0596b704b11af0f8a669352f128ad2d9","https://github.com/pyload/pyload/commit/48f59567393a19263c8a0285256a7537dc9ce109"],"basis":"rarely changed file"}]},{"from":"CVE-2023-47890","to":"CVE-2024-47821","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/pyload/core/api/__init__.py","src/pyload/webui/app/blueprints/json_blueprint.py"],"commits":["https://github.com/pyload/pyload/commit/695bb70cd88608dc4fee18a6a7ecb66722ebfd8f","https://github.com/pyload/pyload/commit/48f59567393a19263c8a0285256a7537dc9ce109"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2024-21645","published":"2024-01-08","fixed":"0.5.0b3.dev77","kev":false},{"cve":"CVE-2024-22416","published":"2024-01-17","fixed":"0.5.0b3.dev78","kev":false},{"cve":"CVE-2024-24808","published":"2024-02-06","fixed":"0.5.0b3.dev79","kev":false,"link":{"from":"CVE-2024-24808","to":"CVE-2024-47821","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pyload-ng","fromFixed":"0.5.0b3.dev79","toFixed":"0.5.0b3.dev87","daysApart":262}]}},{"cve":"CVE-2024-47821","published":"2024-10-25","fixed":"0.5.0b3.dev87","kev":false},{"cve":"CVE-2025-54140","published":"2025-07-22","fixed":"0.5.0b3.dev90","kev":false},{"cve":"CVE-2025-54802","published":"2025-08-05","fixed":"0.5.0b3.dev90","kev":false,"link":{"from":"CVE-2024-47821","to":"CVE-2025-54802","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pyload-ng","fromFixed":"0.5.0b3.dev87","toFixed":"0.5.0b3.dev90","daysApart":284}]}},{"cve":"CVE-2025-55156","published":"2025-08-11","fixed":"0.5.0b3.dev91","kev":false}],"package":"PyPI:pyload-ng"}}