CVE-2026-33511

CVE-2026-33511 concerns pyload-ng/pyLoad where the local_check decorator in the ClickNLoad feature can be bypassed via HTTP Host header spoofing, enabling unauthenticated remote access to localhost‑restricted endpoints and allowing injection of arbitrary downloads, file writes to the storage dire...