EUVD-2026-32957

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to...

CVE-2026-42314

pyLoad/pyload-ng exposes a path traversal via the add_package workflow: folder sanitization replaces ../ with _ but the replacement is bypassable, leaving .. sequences that OS path resolution can interpret. Affected component is add_package in pyload/core/api/init .py; authenticated/ADD-permissio...