Pyload-Ng Project Pyload-Ng vulnerabilities

CVE-2024-32880 [CRITICAL] CWE-434 pyLoad allows upload to arbitrary folder lead to RCE pyLoad allows upload to arbitrary folder lead to RCE ### Summary An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution ### Details example version: 0.5 file:src/pyload/webui/app/blueprints/app_blueprint.py ```python @bp.route("/render/", endpoint="render") def render(filename): mimetype = mimetypes.guess_type(filename)[0] or "

CVE-2025-61773 [HIGH] CWE-116 pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters ### Summary pyLoad web interface contained insufficient input validation in both the Captcha script endpoint and the Click'N'Load (CNL) Blueprint. This flaw allowed untrusted user input to be processed unsafely, which could be exploited by an attacker to inject arbitrary content into the web UI or manipulate

CVE-2026-33992 [CRITICAL] CWE-918 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration ## Summary PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalO

CVE-2026-42315 [MEDIUM] CWE-22 CVE-2026-42315: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when p pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all, allowing a user with Perms.MODIFY to specify arbitrary directories as download locations for a package. This vu

CVE-2026-42312 [MEDIUM] CVE-2026-42312: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the se pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The option ("general", "ssl_verify") is not on that allowlist. Any authen

CVE-2025-57751 [HIGH] CWE-400 Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation. ### Summary The `jk` parameter is received in pyLoad CNL Blueprint. Due to the lack of `jk` parameter verification,

CVE-2026-35586 [MEDIUM] CWE-863 CVE-2026-35586: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADM pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() uses incorrect option names ssl_cert and ssl_key, while the actual configuration option names are ssl_certfile and ssl_keyfile. This name mismatch causes the admin-only check to always evalu

CVE-2026-29778 [MEDIUM] CWE-23 CVE-2026-29778: pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0 pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insufficient sanitization for the pack_folder parameter. The current protection relies on a single-pass string replacement of "../", which can be bypassed using crafted recursive traversal sequences.

CVE-2026-33314 [MEDIUM] CWE-287 CVE-2026-33314: pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check decorator allows unauthenticated external attackers to bypass local-only restrictions. This grants access to the Click'N'Load API endpoints, enabling attackers to remotely queue arbitrary downl

CVE-2026-45306 [HIGH] CWE-706 pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad ## Summary The fix for CVE-2026-33509 prevents setting `storage_folder` inside `PKGDIR` or `userdir`, but does NOT protect the Flask session directory (`/tmp/pyLoad/flask`). An authenticated attacker can set `storage_folder` to the session directory and download sessio

CVE-2023-0509 [HIGH] CWE-295 CVE-2023-0509: Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44. Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

CVE-2026-42314 [MEDIUM] CWE-22 CVE-2026-42314: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, packag pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.

CVE-2026-35592 [MEDIUM] CVE-2026-35592: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _sa pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to wri

CVE-2026-48484 [MEDIUM] CWE-20 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination ## Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set

CVE-2023-0434 [MEDIUM] CWE-20 Improper Input Validation in pyload-ng Improper Input Validation in pyload-ng Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.

CVE-2023-0435 [CRITICAL] CWE-1125 Excessive Attack Surface in pyload-ng Excessive Attack Surface in pyload-ng Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

CVE-2026-48987 [MEDIUM] CWE-400 pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager ## Description: The `EventManager` module in `pyload` manages a list of `Client` instances for subscribing to events. The addition of each unique `uuid` from the `get_events` API causes the creation of a `Client` instance that gets appended to the `clients` list. Although there is a `clean()` method av

CVE-2026-44226 [MEDIUM] CWE-209 PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI ### Summary `pyload-ng` WebUI returns full Python traceback details to clients on unhandled exceptions. Because `/web/` is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception (for e

[MEDIUM] CWE-613 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) ### Summary pyLoad caches `role` and `permission` in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database. As a result, an already logged-in user can keep old (revoked) privileges until logo

CVE-2026-75597 [MEDIUM] CWE-209 pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo pyLoad: Unauthenticated access to /web/ bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo ### Summary The `/web/` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Ever