ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-9Q47-3CM2-2RP8...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-JQ7H-WRVP-3RGX...

GHSA-JQ7H-WRVP-3RGX pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carrying those privileges is never invalidated. pyLoad authorizes each request from values copied into the Flask session at login. setsession in webui/app/helpers.py writes role and...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by CVE-2026-33509 via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: CVE-2026-33509 Source advisory: GHSA-JQ7H-WRVP-3RGX...

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carrying those privileges is never invalidated. pyLoad authorizes each request from values copied into the Flask session at login. setsession in webui/app/helpers.py writes role and...

GHSA-889W-M37P-88M5 pyLoad: Api.set_user_permission never invalidates the target's session

Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented /api/ RPC surface — e.g. POST /api/setuserpermission or its legacy alias /api/setUserPermission — updates the target's database row but never invalidates that user's existing Flask cookie...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: GHSA-889W-M37P-88M5...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-889W-M37P-88M5...

GHSA-P3PR-8F3M-4QP8 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

Summary pyLoad ships the WindowsPhoneNotify addon, whose send method opens an HTTP connection to a host taken directly from the plugin's pushurl configuration value. A user holding the standard non-admin SETTINGS permission can set pushurl and pushid and enable the addon through the web API, sinc...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-P3PR-8F3M-4QP8...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: GHSA-P3PR-8F3M-4QP8...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-FR26-JJHM-638C...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: GHSA-FR26-JJHM-638C...

GHSA-FR26-JJHM-638C pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

Summary UnTar.safeextractall — the hardening added for GHSA-mvwx-582f-56r7 — validates member names and symlink/hardlink targets, but never checks member types, and calls tarfile.extractall without a filter=. On Python : names/links only raise ArchiveError... tar.extractallpath, members,...

GHSA-R44W-V6GF-X3P6 pyLoad has an authentication bypass in API key validation (check_apikey cache)

Summary The API-key cache in checkapikey allows an attacker to authenticate with a forged API key as long as the legitimate key for the same keyid has been used recently. On a cache hit, the API key secret is never verified, resulting in a complete authentication bypass during the cache lifetime...

CVE-2026-75597

The pyLoad download manager is vulnerable to unauthenticated access to sensitive Jinja2 templates. Prior to version 0.5.0b3.dev101 , the /web/ route in src/pyload/webui/app/blueprints/app_blueprint.py fails to enforce authentication, bypassing the @login_required protection used on direct routes ...

CVE-2026-75597 pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...

CVE-2026-75597 pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...

EUVD-2026-95911

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...

GHSA-J92P-C242-7HFX pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

Summary The /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc. is protected by @loginrequired, but the underlying templates for all of these pages...