pyload-ng

Vulnerabilities (43)

• CVE-2025-61773HigOct 9, 2025
  affected < 0.5.0b3.dev91fixed 0.5.0b3.dev91

  pyLoad is a free and open-source download manager written in Python. In versions prior to 0.5.0b3.dev91, pyLoad web interface contained insufficient input validation in both the Captcha script endpoint and the Click'N'Load (CNL) Blueprint. This flaw allowed untrusted user input t

• CVE-2025-57751HigAug 21, 2025
  affected < 0.5.0b3.dev92fixed 0.5.0b3.dev92

  pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU

• CVE-2025-55156HigAug 11, 2025
  affected < 0.5.0b3.dev91fixed 0.5.0b3.dev91

  pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issu

• CVE-2025-54802Aug 5, 2025
  affected < 0.5.0b3.dev90fixed 0.5.0b3.dev90

  pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE).

• CVE-2025-54140HigJul 22, 2025
  affected >= 0.5.0b3.dev89, < 0.5.0b3.dev90fixed 0.5.0b3.dev90

  pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated path traversal vulnerability exists in the /json/upload endpoint of pyLoad. By manipulating the filename of an uploaded file, an attacker can traverse out of the i

• CVE-2025-53890CriJul 15, 2025
  affected < 0.20fixed 0.20

  pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially the backend server. Exploita

• CVE-2025-7346HigJul 8, 2025
  affected <= 0.5.0b3.dev88

  Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages

• CVE-2024-39205CriOct 28, 2024
  affected <= 0.5.0b3.dev85

  An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request.

• CVE-2024-47821Oct 25, 2024
  affected < 0.5.0b3.dev87fixed 0.5.0b3.dev87

  pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote co

• CVE-2024-32880Apr 26, 2024
  affected <= 0.5.0

  pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication.

• CVE-2024-24808Feb 6, 2024
  affected < 0.5.0b3.dev79fixed 0.5.0b3.dev79

  pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` function when redirecting users at login.

• CVE-2024-22416Jan 17, 2024
  affected < 0.5.0b3.dev78fixed 0.5.0b3.dev78

  pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Reque

• CVE-2024-21644Jan 8, 2024
  affected < 0.5.0b3.dev77fixed 0.5.0b3.dev77

  pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.

• CVE-2024-21645Jan 8, 2024
  affected < 0.5.0b3.dev77fixed 0.5.0b3.dev77

  pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can be

• CVE-2023-47890Jan 8, 2024
  affected < 0.5.0b3.dev75fixed 0.5.0b3.dev75

  pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.

• CVE-2023-0509Jan 26, 2023
  affected < 0.5.0b3.dev44fixed 0.5.0b3.dev44

  Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

• CVE-2023-0488Jan 26, 2023
  affected < 0.5.0b3.dev42fixed 0.5.0b3.dev42

  Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.

• CVE-2023-0435Jan 22, 2023
  affected < 0.5.0b3.dev41fixed 0.5.0b3.dev41

  Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

• CVE-2023-0434Jan 22, 2023
  affected < 0.5.0b3.dev40fixed 0.5.0b3.dev40

  Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.

• CVE-2023-0297Jan 14, 2023
  affected < 0.5.0b3.dev31fixed 0.5.0b3.dev31

  Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.