CVE-2024-39205-Pyload-RCE

CVE-2024-39205-Pyload-RCE Pyload RCE with js2py sandbox escape Summary Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Fix Upgrade to the newest version of pyload-...

Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py-

Remote Code Execution – CVE-2024-28397 pyload-ng / js2py This repository contains a Proof-of-Concept PoC exploit for CVE-2024-28397 , a Remote Code Execution vulnerability affecting pyload-ng due to insecure usage of js2py. Disclaimer: This PoC is for educational and research purposes only. Do no...

pyLoad CVE-2023-0297 pyimport RCE

CVE-2023-0297 pyLoad-ng 0.5.0b3.dev31: unauthenticated POST /flash/addcrypted2 evaluates the jk form field via js2py without disablepyimport, allowing pyimport os; os.system.... !/usr/bin/env python3 -- coding: utf-8 -- """pyLoad CVE-2023-0297 pre-auth pyimport RCE via /flash/addcrypted2.""" from...

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

Summary Api.getUserData legacy and Api.getuserdata are declared with @permissionPerms.ANY and are reachable at /api/getUserData and /api/getuserdata. Because Perms.ANY == 0 and pyLoad's permission check is a bitmask AND, that gate is a no-op: every authenticated account passes, including one...

GHSA-68W4-83FH-F2W8 pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

Summary Api.getUserData legacy and Api.getuserdata are declared with @permissionPerms.ANY and are reachable at /api/getUserData and /api/getuserdata. Because Perms.ANY == 0 and pyLoad's permission check is a bitmask AND, that gate is a no-op: every authenticated account passes, including one...

Timing Attack

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Timing Attack via the checkpassword function in src/pyload/core/database/userdatabase.py, which compares password hashes using the == operator rather than a...

User Impersonation

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to User Impersonation via the X-Forwarded-For header in the login endpoint of the web UI. The application reads the first value of the X-Forwarded-For header t...

Insufficient Session Expiration

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Insufficient Session Expiration via the changepassword, removeuser, and setuserpermission API methods, which fail to invalidate existing web sessions when a...

Insufficient Session Expiration

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Insufficient Session Expiration via the changepassword, removeuser, and setuserpermission API methods, which fail to invalidate existing web sessions when a...

Server-side Request Forgery (SSRF)

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the AndroidPhoneNotify and WindowsPhoneNotify notification plugins, which issue outbound HTTP requests to URLs derived...

Directory Traversal

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Directory Traversal via the safeextractall function in UnTar.py, where device file entries embedded in a TAR archive are not rejected before extraction. An...

Authentication Bypass by Primary Weakness

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via an API key cache keyed on keyid instead of the full API key value in checkapikey. Because the cache is indexed...

Missing Authentication for Critical Function

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the render function in appblueprint.py, which serves files under the /web/ route without verifying that the...

Allocation of Resources Without Limits or Throttling

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the web UI's request handling in src/pyload/webui/app/config.py, which lacks a maximum content leng...

PYSEC-2026-2995 pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

Summary isglobaladdress in src/pyload/core/utils/web/check.py is the central guard against SSRF-style outbound connections in pyload-ng. It tests whether a given IP is "globally routable" via Python's ipaddress.ipaddressvalue.isglobal, and callers treat not isglobal as "deny": python def...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by CVE-2026-40071 via pyload-ng (0.5.0b3.dev102)

pyload-ng PYPI version 0.5.0b3.dev102 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: CVE-2026-40071 Source advisory: OSV:PYSEC-2026-2997...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by CVE-2026-33509 +1 more via pyload-ng (0.5.0b3.dev102)

pyload-ng PYPI version 0.5.0b3.dev102 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: CVE-2026-33509, CVE-2026-35464 Source advisory: OSV:PYSEC-2026-2989...

Allocation of Resources Without Limits or Throttling

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the accumulation of Client instances in the clients list within the event management process. An...

Server-side Request Forgery (SSRF)

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the isglobaladdress function. An attacker can access internal network resources or sensitive endpoints by supplying...

PT-2026-56836

Name of the Vulnerable Software and Affected Versions pyload-ng affected versions not specified Description An issue exists where the software is susceptible to Server-Side Request Forgery SSRF. The is global address and is global host functions in src/pyload/core/utils/web/check.py rely on...