CVE-2026-35586 Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMINONLYCOREOPTIONS authorization set in setconfigvalue uses incorrect option names sslcert and sslkey, while the actual configuration option names are sslcertfile and sslkeyfile. This name mismatch...

CVE-2026-35586

creationtimestamp| type| source ---|---|--- 2026-04-04 09:16:32+00:00| published-proof-of-concept| https://github.com/pyload/pyload/security/advisories/GHSA-ppvx-rwh9-7rj7...