pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad

Summary The fix for CVE-2026-33509 prevents setting storagefolder inside PKGDIR or userdir, but does NOT protect the Flask session directory /tmp/pyLoad/flask. An authenticated attacker can set storagefolder to the session directory and download session files of other users via /files/get/, leadi...

pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)

Summary The fix for CVE-2026-33509 GHSA-r7mc-x6x7-cqxx added an ADMINONLYOPTIONS set to block non-admin users from modifying security-critical config options. The storagefolder option is not in this set and passes the existing path restriction because the Flask session directory is outside both...

CVE-2026-33509

creationtimestamp| type| source ---|---|--- 2026-03-20 20:12:54+00:00| published-proof-of-concept| https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxx 2026-03-24 19:16:30+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-33509 2026-03-26...

EUVD-2025-33509

Malicious code in redirect-r0ajvl npm...

CVE-2024-33509

An improper certificate validation vulnerability CWE-295 in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the...

CVE-2023-33509

KramerAV VIA GO² 4.0.1.1326 is vulnerable to SQL Injection...

Fortinet FortiWeb ] Lack of client-side certificate validation when establishing secure connections (FG-IR-22-326)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-326 advisory. - An improper certificate validation vulnerability CWE-295 in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions...

CVE-2024-33509

creationtimestamp| type| source ---|---|--- 2024-07-09 18:57:59+00:00| seen| https://t.me/cvedetector/376...

CVE-2024-33509

CVE-2024-33509 is an improper certificate validation (CWE-295) vulnerability in FortiWeb. A remote, unauthenticated attacker in a MITM position could decipher and/or tamper with the communication channel between FortiWeb and endpoints used to fetch WAF data. Affected FortiWeb versions include 6.3...

CVE-2023-33509

creationtimestamp| type| source ---|---|--- 2023-05-31 16:36:47+00:00| seen| https://t.me/cibsecurity/64814...

CVE-2023-33509

KramerAV VIA GO² 4.0.1.1326 is vulnerable to SQL Injection...

CVE-2023-33509

KramerAV VIA GO² 4.0.1.1326 is vulnerable to SQL Injection...

CVE-2023-33509

CVE-2023-33509 affects KramerAV VIA GO² before version 4.0.1.1326, with a SQL injection vulnerability reported. The CVSS base metrics indicate CRITICAL impact to confidentiality, integrity, and availability (network attack, no user interaction). Remediation: update to 4.0.1.1326 or later where fi...

CVE-2021-33509

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

CVE-2021-33509

Plone 5.2.4 and earlier are affected by an arbitrary file-write vulnerability. Remote authenticated managers can cause disk I/O by sending crafted keyword arguments to the ReStructuredText transform in Python scripts, enabling potential file writes to the server. Root cause is exposed via docutil...