CVE-2024-47821 - CVE House
Back to Database
Status published Critical CVE-2024-47821

pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

Vulnerability Description

pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved in versions prior to 0.5.0b3.dev87. A file can be downloaded to such a folder by changing the download folder to a folder in `/scripts` path and using the `/flashgot` API to download the file. This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system. Version 0.5.0b3.dev87 fixes this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47821

Credits & Attribution

No credits recorded in the NVD database.

References

More from pyload

View All →
CVE-2025-61773
pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters
High 8.1
CVE-2025-57751
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
High 7.7
CVE-2025-55156
PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
High 7.8
CVE-2025-54802
pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)
Critical 9.8
CVE-2025-54140
pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write
High 7.5

Affected Vendor

Affected Software

pyload
Vulnerable Versions:
< 0.5.0b3.dev87

Timeline

Official Publish: October 25th, 2024
Last Modified: October 28th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration