An attacker who obtains the SETTINGS permission in pyLoad can alter the AntiVirus plugin’s avfile configuration value. The application passes this value straight to subprocess.Popen without sanitization, allowing the attacker to inject an arbitrary command line. As a consequence, the attacker can execute arbitrary shell commands with the privileges of the pyLoad process, which is typically a privileged user on the host. This flaw results in a high‑severity remote code execution vulnerability.

The flaw affects pyLoad, specifically version 0.5.0b3.dev96 and earlier. Only plugin configuration values are vulnerable; core configuration options remain protected. Users with SETTINGS permission who can edit plugin settings are at risk when using these releases.

The CVSS base score of 8.8 reflects the high exploitation potential and impact. No EPSS data is available, and the vulnerability is not listed in KEV. The attack vector is internal through the web interface; an attacker needs only SETTINGS permission to modify the avfile value. Because the flaw allows execution of arbitrary commands, the risk to confidentiality, integrity, and availability is complete system compromise. The overall exploitability is therefore high.