Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pyload-ng | pip | <= 0.5.0b3.dev99 |
Miggo AIRoot Cause AnalysisThe vulnerability is a result of an incomplete fix for a previous path traversal vulnerability (CVE-2026-33509). An authenticated attacker with SETTINGS permission can exploit this vulnerability to achieve account takeover of other users. The attack involves two main steps. First, the attacker calls the Api.set_config_value function to set the storage_folder configuration to the application's session directory (/tmp/pyLoad/flask). The validation within set_config_value was insufficient as it did not prevent setting this specific sensitive path. Second, the attacker calls the endpoint handled by Files.get, which is designed to serve files from the storage_folder. Because the storage_folder now points to the session directory, the attacker can download the session files of other users, hijack their sessions, and gain full control of their accounts. The fix for this vulnerability involved updating the validation in Api.set_config_value to also block the session cache directory path.
