The flaw in pyLoad originates from an incomplete permission check on the storage_folder option. Because this option is not protected by the ADMIN_ONLY_OPTIONS guard, users who hold SETTINGS and ADD rights can point downloads to the Flask session directory, plant a malicious pickle payload as a predictable session file, and force the application to load that payload when any HTTP request is made with the corresponding session cookie. This results in arbitrary code execution on the host where pyLoad runs. The vulnerability is a form of insecure deserialization and improper access control, as identified by CWE‑502 and CWE‑863.

pyLoad, an open‑source Python download manager. All instances that allow users with SETTINGS and ADD capabilities to modify the storage_folder configuration are affected. Any deployment using an older code base prior to the commit c4cf995a2803bdbe388addfc2b0f323277efc0e1 inherits the flaw.

The CVSS score of 7.5 indicates a high severity. Exploitation requires that the attacker already has a valid session with SETTINGS and ADD permissions, a privilege level that is typically granted to trusted users but still represents a user‑level attack vector. The EPSS score is not provided, and the vulnerability is currently not listed in the KEV catalog. Because the attack can be triggered by a normal HTTP request once the malicious session file is in place, the potential impact is system‑wide code execution for the user under which pyLoad operates.