pyLoad is a free, open‑source download manager written in Python. A flaw in the handling of the "storage_folder" configuration parameter allowed an authenticated user to point the download directory to the Flask session folder (/tmp/pyLoad/flask). This enabled the attacker to retrieve session files belonging to other users via the "/files/get/" endpoint, effectively compromising their accounts. The vulnerability was present in all releases before 0.5.0b3.dev100 and is specifically mitigated in that version and later.

All installations of pyLoad older than 0.5.0b3.dev100 are affected. The issue applies to the pyLoad download manager distributed under the pyload:pyload product line. Users running any pre‑0.5.0b3.dev100 release of the software are at risk.

The CVSS score of 6.5 indicates medium severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that publicly known exploitation has not yet been documented. Attackers must first authenticate to the system; once authenticated they can adjust the storage_folder setting, exploit the flaw, and retrieve other users’ session data. The risk is moderate: a credential compromise can lead to a complete account takeover, but the need for valid credentials reduces automatic exploitation likelihood.