Description
pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check decorator allows unauthenticated external attackers to bypass local-only restrictions. This grants access to the Click'N'Load API endpoints, enabling attackers to remotely queue arbitrary downloads, leading to Server-Side Request Forgery (SSRF) and Denial of Service (DoS). This issue has been patched in version 0.5.0b3.dev97.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pyload | pyload | < 0.5.0b3.dev97 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pyload-ng | < 0.5.0b3.dev97 | 0.5.0b3.dev97 | GHSA-q485-cg9q-xq2r |