Search for packages
| purl | pkg:pypi/pyload-ng@0.5.0b3.dev99 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8w3f-4r8f-pf53
Aliases: CVE-2025-53890 |
pyLoad vulnerable to XSS through insecure CAPTCHA #### Summary An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows … | There are no reported fixed by versions. |
|
GHSA-3f7w-p8vr-4v5f
Aliases: CVE-2024-32880 |
pyLoad allows upload to arbitrary folder lead to RCE ### Summary An authenticated user can change the download folder and … | There are no reported fixed by versions. |
|
GHSA-4744-96p5-mp2j
Aliases: CVE-2026-35464 |
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509) ## Summary … | There are no reported fixed by versions. |
|
PYSEC-2026-128
Aliases: CVE-2026-42314 GHSA-97r3-5w84-r4q8 |
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using … |
Vulnerable |
|
PYSEC-2026-127
Aliases: CVE-2026-42313 GHSA-pg67-9wjv-mr85 |
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in … |
Vulnerable |
|
PYSEC-2026-129
Aliases: CVE-2026-42315 GHSA-838g-gr43-qqg9 |
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in … |
Vulnerable |
|
PYSEC-2026-126
Aliases: CVE-2026-42312 GHSA-ccxc-x975-4hh9 |
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in … |
Vulnerable |
|
PYSEC-2024-302
Aliases: CVE-2024-47821 GHSA-w7hq-f2pj-c53g |
pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are … | There are no reported fixed by versions. |
|
PYSEC-2026-2992
Aliases: CVE-2026-48987 GHSA-c2f9-4mc8-j656 |
pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager ## Description: The `EventManager` module in `pyload` manages … | There are no reported fixed by versions. |
|
PYSEC-2026-2998
Aliases: CVE-2026-45306 GHSA-w727-595x-pc3r |
pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad ## Summary The fix for CVE-2026-33509 prevents … | There are no reported fixed by versions. |
|
PYSEC-2026-2989
Aliases: CVE-2026-35464 GHSA-4744-96p5-mp2j |
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509) ## Summary … | There are no reported fixed by versions. |
|
PYSEC-2026-492
Aliases: CVE-2024-32880 GHSA-3f7w-p8vr-4v5f |
pyLoad allows upload to arbitrary folder lead to RCE ### Summary An authenticated user can change the download folder and … | There are no reported fixed by versions. |
|
PYSEC-2026-2997
Aliases: CVE-2026-40071 GHSA-rfgh-63mg-8pwm |
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions ### Summary Several WebUI JSON endpoints … | There are no reported fixed by versions. |
|
PYSEC-2026-2995
Aliases: CVE-2026-48737 GHSA-m5x5-28jr-gpjj |
pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs ## Summary `is_global_address` in [`src/pyload/core/utils/web/check.py`](https://github.com/pyload/pyload/blob/1b12dc7f348db8c144e0f39215680415e90ca4d2/src/pyload/core/utils/web/check.py) is the central … | There are no reported fixed by versions. |
|
PYSEC-2026-2991
Aliases: CVE-2026-46561 GHSA-8rp3-xc6w-5qp5 |
pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API ## Summary The SSRF mitigation added in commit `33c55da` for GHSA-7gvf-3w72-p2pg … |
Vulnerable |
|
PYSEC-2026-2993
Aliases: CVE-2026-44226 GHSA-c3gc-9pf2-84gg |
PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI ### Summary `pyload-ng` WebUI returns full Python traceback … |
Vulnerable |
|
PYSEC-2026-496
Aliases: CVE-2025-53890 GHSA-8w3f-4r8f-pf53 |
pyLoad vulnerable to XSS through insecure CAPTCHA #### Summary An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows … | There are no reported fixed by versions. |
|
PYSEC-2026-2994
Aliases: CVE-2026-45348 GHSA-fcjq-435v-jx94 |
pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal ## Summary The … | There are no reported fixed by versions. |
|
GHSA-r44w-v6gf-x3p6
|
pyLoad has an authentication bypass in API key validation (check_apikey cache) ## Summary The API-key cache in `check_apikey()` allows an … |
Vulnerable |
|
GHSA-fr26-jjhm-638c
|
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=) ### Summary `UnTar._safe_extractall` — … | There are no reported fixed by versions. |
|
GHSA-jq7h-wrvp-3rgx
|
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session An admin who revokes … | There are no reported fixed by versions. |
|
GHSA-889w-m37p-88m5
|
pyLoad: Api.set_user_permission never invalidates the target's session ### Summary An admin who revokes or downgrades a non-admin user's permissions through … | There are no reported fixed by versions. |
|
GHSA-68w4-83fh-f2w8
|
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password ## Summary `Api.getUserData` (legacy) and `Api.get_userdata` … | There are no reported fixed by versions. |
|
PYSEC-2026-4293
Aliases: CVE-2026-48484 GHSA-vq8p-m3wm-gv5f |
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination ## Description: The API `rpc` … |
Vulnerable |
|
PYSEC-2026-4292
Aliases: CVE-2026-75597 GHSA-j92p-c242-7hfx |
pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo ### … |
Vulnerable |
|
GHSA-p3pr-8f3m-4qp8
|
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host ## Summary pyLoad ships the WindowsPhoneNotify addon, … | There are no reported fixed by versions. |