pyload

10 results · Clear filters · Feed

• Critical 9.4
  CVE-2026-123815

  pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in…

  pyload pyload
  Nov 9, 2026
• Critical 9.3
  CVE-2026-35459

  pyLoad has SSRF fix bypass via HTTP redirect

  pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-2026-33992 added IP validation to BaseDownloader.download() that checks the hostn…

  pyload pyload pyload-ng PyPI
  Apr 6, 2026
• Critical 9.3
  CVE-2026-33992

  pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

  pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker can exploit…

  pyload pyload pyload-ng PyPI
  Mar 27, 2026
• Critical 9.8
  CVE-2025-54802

  pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)

  pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote C…

  pyload pyload pyload-ng PyPI
  Aug 5, 2025
• Critical 9.8
  CVE-2025-53890

  pyLoad vulnerable to remote code execution through js2py onCaptchaResult

  pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially the bac…

  pyload pyload pyload-ng PyPI
  Jul 14, 2025
• Critical 9.1
  CVE-2024-47821

  pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

  pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respect…

  pyload pyload pyload-ng PyPI
  Oct 25, 2024
• Critical 9.1
  CVE-2024-32880

  pyLoad allows upload to arbitrary folder lead to RCE

  pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication.

  pyload pyload pyload-ng PyPI
  Apr 26, 2024
• Critical 9.7
  CVE-2024-22416 Public exploit

  Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

  pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities v…

  pyload pyload pyload-ng PyPI
  Jan 17, 2024
• Critical 9.6
  CVE-2023-0488

  Cross-site Scripting (XSS) - Stored in pyload/pyload

  Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.

  pyload pyload/pyload pyload-ng PyPI
  Jan 26, 2023
• Critical 9.8
  CVE-2023-0297 Public exploit EPSS 96%

  Code Injection in pyload/pyload

  Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.

  pyload pyload/pyload pyload-ng PyPI
  Jan 14, 2023