Pyload
by Pyload
Source repositories
CVEs (41)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-33511 | 0.00 | — | 0.00 | Mar 24, 2026 | pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows… | |||
| CVE-2026-33509 | 0.00 | — | 0.01 | Mar 24, 2026 | pyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API endpoint allows users with the non-admin SETTINGS permission to modify any configuration option without restriction. The… | |||
| CVE-2026-33314 | 0.00 | — | 0.00 | Mar 24, 2026 | pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check decorator allows unauthenticated external attackers to bypass local-only restrictions. This grants access to the… | |||
| CVE-2026-32808 | 0.00 | — | 0.00 | Mar 20, 2026 | pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside… | |||
| CVE-2026-29778 | 0.00 | — | 0.01 | Mar 7, 2026 | pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insufficient sanitization for the pack_folder parameter. The current protection relies on a single-pass string replacement of… | |||
| CVE-2025-54802 | 0.00 | — | 0.01 | Aug 5, 2025 | pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE).… | |||
| CVE-2024-1240 | 0.00 | — | 0.00 | Nov 15, 2024 | An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for… | |||
| CVE-2024-47821 | 0.00 | — | 0.01 | Oct 25, 2024 | pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote… | |||
| CVE-2024-32880 | 0.00 | — | 0.01 | Apr 26, 2024 | pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication. | |||
| CVE-2024-24808 | 0.00 | — | 0.01 | Feb 6, 2024 | pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` function when redirecting users at… | |||
| CVE-2024-22416 | 0.00 | — | 0.01 | Jan 17, 2024 | pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site… | |||
| CVE-2024-21644 | 0.00 | — | 0.42 | Jan 8, 2024 | pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77. | |||
| CVE-2024-21645 | 0.00 | — | 0.25 | Jan 8, 2024 | pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can… | |||
| CVE-2023-47890 | 0.00 | — | 0.01 | Jan 8, 2024 | pyLoad 0.5.0 is vulnerable to Unrestricted File Upload. | |||
| CVE-2023-0509 | 0.00 | — | 0.01 | Jan 26, 2023 | Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44. | |||
| CVE-2023-0488 | 0.00 | — | 0.01 | Jan 26, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42. | |||
| CVE-2023-0435 | 0.00 | — | 0.01 | Jan 22, 2023 | Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41. | |||
| CVE-2023-0434 | 0.00 | — | 0.01 | Jan 22, 2023 | Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40. | |||
| CVE-2023-0227 | 0.00 | — | 0.01 | Jan 12, 2023 | Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36. | |||
| CVE-2023-0057 | 0.00 | — | 0.00 | Jan 5, 2023 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33. |
- CVE-2026-33511Mar 24, 2026risk 0.00cvss —epss 0.00
pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows…
- CVE-2026-33509Mar 24, 2026risk 0.00cvss —epss 0.01
pyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API endpoint allows users with the non-admin SETTINGS permission to modify any configuration option without restriction. The…
- CVE-2026-33314Mar 24, 2026risk 0.00cvss —epss 0.00
pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check decorator allows unauthenticated external attackers to bypass local-only restrictions. This grants access to the…
- CVE-2026-32808Mar 20, 2026risk 0.00cvss —epss 0.00
pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside…
- CVE-2026-29778Mar 7, 2026risk 0.00cvss —epss 0.01
pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insufficient sanitization for the pack_folder parameter. The current protection relies on a single-pass string replacement of…
- CVE-2025-54802Aug 5, 2025risk 0.00cvss —epss 0.01
pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE).…
- CVE-2024-1240Nov 15, 2024risk 0.00cvss —epss 0.00
An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for…
- CVE-2024-47821Oct 25, 2024risk 0.00cvss —epss 0.01
pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote…
- CVE-2024-32880Apr 26, 2024risk 0.00cvss —epss 0.01
pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication.
- CVE-2024-24808Feb 6, 2024risk 0.00cvss —epss 0.01
pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` function when redirecting users at…
- CVE-2024-22416Jan 17, 2024risk 0.00cvss —epss 0.01
pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site…
- CVE-2024-21644Jan 8, 2024risk 0.00cvss —epss 0.42
pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.
- CVE-2024-21645Jan 8, 2024risk 0.00cvss —epss 0.25
pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can…
- CVE-2023-47890Jan 8, 2024risk 0.00cvss —epss 0.01
pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.
- CVE-2023-0509Jan 26, 2023risk 0.00cvss —epss 0.01
Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.
- CVE-2023-0488Jan 26, 2023risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.
- CVE-2023-0435Jan 22, 2023risk 0.00cvss —epss 0.01
Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.
- CVE-2023-0434Jan 22, 2023risk 0.00cvss —epss 0.01
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
- CVE-2023-0227Jan 12, 2023risk 0.00cvss —epss 0.01
Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.
- CVE-2023-0057Jan 5, 2023risk 0.00cvss —epss 0.00
Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.
Page 2 of 3