An authenticated remote code execution vulnerability in pyLoad allows attackers to compromise the host system by exploiting insecure deserialization through manipulated session files.

This issue involves incorrect authorization (CWE-863) and deserialization of untrusted data (CWE-502). An authenticated user with SETTINGS and ADD permissions can redirect download paths to the Flask session directory, planting a malicious pickle payload that triggers arbitrary code execution upon processing a crafted session cookie.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the underlying server. This poses a severe risk to data confidentiality, integrity, and availability, potentially leading to full system compromise. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized administrative control.

Immediate Action: As no official release version containing the fix is specified, users must apply the fix from the upstream commit c4cf995a2803bdbe388addfc2b0f323277efc0e1 directly to their source code or restrict access to the application to trusted personnel only.

Proactive Monitoring: Security teams should monitor server access logs for unusual session activity or attempts to modify download storage paths by non-administrative users.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall to monitor and block requests containing serialized object patterns or suspicious session manipulation attempts.

Public Exploit Available: Unknown.

Given the potential for remote code execution, this vulnerability represents a significant security risk to any environment hosting pyLoad. Organizations should prioritize applying the provided code-level fix or limiting application access until a stable, patched version is released by the vendor. Failure to address this flaw could lead to complete server compromise.