Search for packages
| purl | pkg:pypi/pyload-ng@0.5.0b3.dev31 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-3wwm-hjv7-23r3
|
Pyload log Injection via API /json/add_package in add_name parameter ### Summary A log injection vulnerability was identified in `pyload` in … | There are no reported fixed by versions. |
|
GHSA-8w3f-4r8f-pf53
Aliases: CVE-2025-53890 |
pyLoad vulnerable to XSS through insecure CAPTCHA #### Summary An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows … | There are no reported fixed by versions. |
|
GHSA-2wcm-vx67-3x4q
|
Duplicate Advisory: GHSA-x698-5hjm-w2m5 ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x698-5hjm-w2m5. This link … | There are no reported fixed by versions. |
|
GHSA-25pw-q952-x37g
|
Duplicate Advisory: pyload-ng vulnerable to RCE with js2py sandbox escape ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-w7hq-f2pj-c53g
Aliases: CVE-2024-47821 |
pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API ### Summary The folder `/.pyload/scripts` has scripts … |
Vulnerable |
|
GHSA-3f7w-p8vr-4v5f
Aliases: CVE-2024-32880 |
pyLoad allows upload to arbitrary folder lead to RCE ### Summary An authenticated user can change the download folder and … | There are no reported fixed by versions. |
|
GHSA-mp82-fmj6-f22v
Aliases: CVE-2026-40594 |
pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition) ## Summary The `set_session_cookie_secure` … |
Vulnerable |
|
GHSA-fj52-5g4h-gmq8
|
pyLoad's Session Not Invalidated After Permission Changes ### Summary The `pyload` application does not properly invalidate or modify sessions upon … | There are no reported fixed by versions. |
|
GHSA-4744-96p5-mp2j
Aliases: CVE-2026-35464 |
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509) ## Summary … | There are no reported fixed by versions. |
|
GHSA-w48f-wwwf-f5fr
Aliases: CVE-2026-35463 |
pyLoad: Improper Neutralization of Special Elements used in an OS Command ### Summary The `ADMIN_ONLY_OPTIONS` protection mechanism restricts security-critical configuration … | There are no reported fixed by versions. |
|
GHSA-97r3-5w84-r4q8
Aliases: CVE-2026-42314 |
PyLoad Vulnerable to Path Traversal via Package Folder Name Insufficient sanitization of package folder names allows writing files outside the … |
Vulnerable |
|
GHSA-r7mc-x6x7-cqxx
Aliases: CVE-2026-33509 |
pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration ## Summary The `set_config_value()` API endpoint … | There are no reported fixed by versions. |
|
PYSEC-2024-123
Aliases: CVE-2024-1240 |
An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter … | There are no reported fixed by versions. |
|
PYSEC-2026-125
Aliases: CVE-2026-40594 GHSA-mp82-fmj6-f22v |
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload/webui/app/__init__.py … |
Vulnerable |
|
PYSEC-2026-123
Aliases: CVE-2026-35586 GHSA-ppvx-rwh9-7rj7 |
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() … |
Vulnerable |
|
PYSEC-2026-121
Aliases: CVE-2026-29778 GHSA-6px9-j4qr-xfjw |
pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements … |
Vulnerable |
|
PYSEC-2026-128
Aliases: CVE-2026-42314 GHSA-97r3-5w84-r4q8 |
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using … |
Vulnerable |
|
PYSEC-2026-124
Aliases: CVE-2026-35592 GHSA-mvwx-582f-56r7 |
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses … |
Vulnerable |
|
PYSEC-2026-127
Aliases: CVE-2026-42313 GHSA-pg67-9wjv-mr85 |
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in … |
Vulnerable |
|
PYSEC-2024-123
Aliases: CVE-2024-1240 |
An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter … | There are no reported fixed by versions. |
|
PYSEC-2026-122
Aliases: CVE-2026-33314 GHSA-q485-cg9q-xq2r |
pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability … |
Vulnerable |
|
PYSEC-2026-129
Aliases: CVE-2026-42315 GHSA-838g-gr43-qqg9 |
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in … |
Vulnerable |
|
PYSEC-2026-126
Aliases: CVE-2026-42312 GHSA-ccxc-x975-4hh9 |
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in … |
Vulnerable |
|
PYSEC-2024-302
Aliases: CVE-2024-47821 GHSA-w7hq-f2pj-c53g |
pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are … | There are no reported fixed by versions. |
|
PYSEC-2024-17
Aliases: CVE-2024-22416 GHSA-pgpj-v85q-h5fm |
pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to … |
Vulnerable |
|
PYSEC-2026-499
Aliases: CVE-2024-39205 GHSA-r9pp-r4xf-597r |
pyload-ng vulnerable to RCE with js2py sandbox escape ### Summary Any pyload-ng running under python3.11 or below are vulnerable under … | There are no reported fixed by versions. |
|
PYSEC-2026-493
Aliases: CVE-2025-54802 GHSA-48rp-jc79-2264 |
pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE) ### Summary **Path Traversal in … |
Vulnerable |
|
PYSEC-2026-494
Aliases: CVE-2023-0435 GHSA-6jmx-pv77-wm5w |
Excessive Attack Surface in pyload-ng Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41. |
Vulnerable |
|
PYSEC-2026-497
Aliases: CVE-2026-33992 GHSA-m74m-f7cr-432x |
pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration ## Summary PyLoad's download engine accepts arbitrary URLs … | There are no reported fixed by versions. |
|
PYSEC-2026-495
Aliases: CVE-2026-35459 GHSA-7gvf-3w72-p2pg |
pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992) ## Summary The fix for CVE-2026-33992 (GHSA-m74m-f7cr-432x) … | There are no reported fixed by versions. |
|
PYSEC-2026-2996
Aliases: CVE-2026-33509 GHSA-r7mc-x6x7-cqxx |
pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration ## Summary The `set_config_value()` API endpoint … | There are no reported fixed by versions. |
|
PYSEC-2026-2267
Aliases: CVE-2026-35463 GHSA-w48f-wwwf-f5fr |
pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts … |
Vulnerable |
|
PYSEC-2026-2992
Aliases: CVE-2026-48987 GHSA-c2f9-4mc8-j656 |
pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager ## Description: The `EventManager` module in `pyload` manages … | There are no reported fixed by versions. |
|
PYSEC-2026-2988
Aliases: CVE-2026-35187 GHSA-2wvg-62qm-gj33 |
pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter ## Vulnerability Details **CWE-918**: Server-Side Request Forgery (SSRF) The `parse_urls` … | There are no reported fixed by versions. |
|
PYSEC-2026-2998
Aliases: CVE-2026-45306 GHSA-w727-595x-pc3r |
pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad ## Summary The fix for CVE-2026-33509 prevents … | There are no reported fixed by versions. |
|
PYSEC-2026-1821
Aliases: CVE-2025-55156 GHSA-pwh4-6r3m-j2rf |
PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter ### Summary The parameter `add_links` in the API /json/add_package … |
Vulnerable |
|
PYSEC-2026-1820
Aliases: CVE-2024-21644 GHSA-mqpq-2p68-46fv |
pyload Unauthenticated Flask Configuration Leakage vulnerability ### Summary Any unauthenticated user can browse to a specific URL to expose the … |
Vulnerable |
|
PYSEC-2026-1819
Aliases: CVE-2023-47890 GHSA-h73m-pcfw-25h2 |
Download to arbitrary folder can lead to RCE ### Summary A web UI user can store files anywhere on the … |
Vulnerable |
|
PYSEC-2026-2989
Aliases: CVE-2026-35464 GHSA-4744-96p5-mp2j |
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509) ## Summary … | There are no reported fixed by versions. |
|
PYSEC-2026-492
Aliases: CVE-2024-32880 GHSA-3f7w-p8vr-4v5f |
pyLoad allows upload to arbitrary folder lead to RCE ### Summary An authenticated user can change the download folder and … | There are no reported fixed by versions. |
|
PYSEC-2026-2997
Aliases: CVE-2026-40071 GHSA-rfgh-63mg-8pwm |
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions ### Summary Several WebUI JSON endpoints … | There are no reported fixed by versions. |
|
PYSEC-2026-904
Aliases: CVE-2023-0057 GHSA-h8r9-467r-vjjf |
pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames Improper Restriction of Rendered UI Layers or Frames in … |
Vulnerable |
|
PYSEC-2026-905
Aliases: CVE-2023-0055 GHSA-m3g7-wrrq-v5c8 |
Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub … |
Vulnerable |
|
PYSEC-2026-2995
Aliases: CVE-2026-48737 GHSA-m5x5-28jr-gpjj |
pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs ## Summary `is_global_address` in [`src/pyload/core/utils/web/check.py`](https://github.com/pyload/pyload/blob/1b12dc7f348db8c144e0f39215680415e90ca4d2/src/pyload/core/utils/web/check.py) is the central … | There are no reported fixed by versions. |
|
PYSEC-2026-2991
Aliases: CVE-2026-46561 GHSA-8rp3-xc6w-5qp5 |
pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API ## Summary The SSRF mitigation added in commit `33c55da` for GHSA-7gvf-3w72-p2pg … |
Vulnerable |
|
PYSEC-2026-906
Aliases: CVE-2023-0227 GHSA-rv9x-wmw4-44qj |
Pyload Insufficient Session Expiration vulnerability Pyload 0.5.0b3.dev35 has an Insufficient Session Expiration vulnerability. A patch is available and anticipated to … | There are no reported fixed by versions. |
|
PYSEC-2026-903
Aliases: CVE-2023-0509 GHSA-8v53-23mx-hcf9 |
Improper Certificate Validation in pyload-ng Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44. |
Vulnerable |
|
PYSEC-2026-1816
Aliases: CVE-2025-61773 GHSA-cjjf-27cc-pvmv |
pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters ### Summary pyLoad web interface contained insufficient input validation … |
Vulnerable |
|
PYSEC-2026-1818
Aliases: CVE-2024-21645 GHSA-ghmw-rwh8-6qmr |
pyload Log Injection vulnerability ### Summary A log injection vulnerability was identified in `pyload`. This vulnerability allows any unauthenticated actor … |
Vulnerable |
|
PYSEC-2026-2990
Aliases: CVE-2026-41133 GHSA-66hx-chf7-3332 |
pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) ### Summary pyLoad caches `role` and `permission` in the … | There are no reported fixed by versions. |
|
PYSEC-2026-907
Aliases: CVE-2023-0488 GHSA-wcm6-wv95-7jw6 |
Cross-site Scripting in pyload-ng Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42. |
Vulnerable |
|
PYSEC-2026-2993
Aliases: CVE-2026-44226 GHSA-c3gc-9pf2-84gg |
PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI ### Summary `pyload-ng` WebUI returns full Python traceback … |
Vulnerable |
|
PYSEC-2026-1817
Aliases: CVE-2024-24808 GHSA-g3cm-qg2v-2hj5 |
pyLoad open redirect vulnerability due to improper validation of the is_safe_url function ### Summary Open redirect vulnerability due to incorrect … |
Vulnerable |
|
PYSEC-2026-908
Aliases: CVE-2023-0434 GHSA-x9vc-5q77-m7x4 |
Improper Input Validation in pyload-ng Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40. |
Vulnerable |
|
PYSEC-2026-496
Aliases: CVE-2025-53890 GHSA-8w3f-4r8f-pf53 |
pyLoad vulnerable to XSS through insecure CAPTCHA #### Summary An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows … | There are no reported fixed by versions. |
|
PYSEC-2026-1815
Aliases: CVE-2025-57751 GHSA-9gjj-6gj7-c4wj |
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs Dear Maintainers, I am writing to you on behalf of the Tencent … |
Vulnerable |
|
PYSEC-2026-1822
Aliases: CVE-2025-7346 GHSA-x698-5hjm-w2m5 |
pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages ### Summary Any unauthenticated attacker … | There are no reported fixed by versions. |
|
PYSEC-2026-2994
Aliases: CVE-2026-45348 GHSA-fcjq-435v-jx94 |
pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal ## Summary The … | There are no reported fixed by versions. |
|
GHSA-r44w-v6gf-x3p6
|
pyLoad has an authentication bypass in API key validation (check_apikey cache) ## Summary The API-key cache in `check_apikey()` allows an … |
Vulnerable |
|
GHSA-fr26-jjhm-638c
|
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=) ### Summary `UnTar._safe_extractall` — … | There are no reported fixed by versions. |
|
GHSA-jq7h-wrvp-3rgx
|
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session An admin who revokes … | There are no reported fixed by versions. |
|
GHSA-68w4-83fh-f2w8
|
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password ## Summary `Api.getUserData` (legacy) and `Api.get_userdata` … | There are no reported fixed by versions. |
|
PYSEC-2026-4293
Aliases: CVE-2026-48484 GHSA-vq8p-m3wm-gv5f |
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination ## Description: The API `rpc` … |
Vulnerable |
|
PYSEC-2026-4292
Aliases: CVE-2026-75597 GHSA-j92p-c242-7hfx |
pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo ### … |
Vulnerable |
|
GHSA-p3pr-8f3m-4qp8
|
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host ## Summary pyLoad ships the WindowsPhoneNotify addon, … | There are no reported fixed by versions. |
|
GHSA-rfgh-63mg-8pwm
Aliases: CVE-2026-40071 |
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions ### Summary Several WebUI JSON endpoints … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
PYSEC-2026-498
|
Code Injection in pyload-ng Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. |
CVE-2023-0297
GHSA-pf38-5p22-x6h6 |