CVE-2023-0227
Insufficient Session Expiration in pyload/pyload
CVE-2023-0227 is a high vulnerability (CVSS 8.3) in Pyload, published January 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in pyload-ng 0.5.0b3.dev36.
Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Insufficient Session Expiration in pyload/pyload
Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.
- Record
CVE-2023-0227- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
EUVDEUVD-2023-0548
Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.
- Record
EUVD-2023-0548- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rv9x-wmw4-44qj
Pyload Insufficient Session Expiration vulnerability
Pyload 0.5.0b3.dev35 has an Insufficient Session Expiration vulnerability. A patch is available and anticipated to be part of version 0.5.0b3.dev36.
- Record
GHSA-rv9x-wmw4-44qj- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
NVD
Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.
- Record
CVE-2023-0227- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
OSV
Insufficient Session Expiration in pyload/pyload
Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.
- Record
CVE-2023-0227- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
OSVGHSA-rv9x-wmw4-44qj
Pyload Insufficient Session Expiration vulnerability
Pyload 0.5.0b3.dev35 has an Insufficient Session Expiration vulnerability. A patch is available and anticipated to be part of version 0.5.0b3.dev36.
- Record
GHSA-rv9x-wmw4-44qj- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
OSVPYSEC-2026-906
Pyload Insufficient Session Expiration vulnerability
Pyload 0.5.0b3.dev35 has an Insufficient Session Expiration vulnerability. A patch is available and anticipated to be part of version 0.5.0b3.dev36.
- Record
PYSEC-2026-906- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyload-ngPyPI |
through 0.5.0b3.dev35 | 0.5.0b3.dev36 |
pyload-ngPyPI |
before 0.5.0b3.dev36, plus listed versions 0.5.0a5.dev5280.5.0a5.dev5320.5.0a5.dev5350.5.0a5.dev5360.5.0a5.dev537 Show 45 moreShow less0.5.0a5.dev5390.5.0a5.dev5400.5.0a5.dev5450.5.0a5.dev5620.5.0a5.dev5640.5.0a5.dev5650.5.0a6.dev5700.5.0a6.dev5780.5.0a6.dev5870.5.0a7.dev5960.5.0a8.dev6020.5.0a9.dev6150.5.0a9.dev6290.5.0a9.dev6320.5.0a9.dev6410.5.0a9.dev6430.5.0a9.dev6550.5.0a9.dev8060.5.0b1.dev10.5.0b1.dev20.5.0b1.dev30.5.0b1.dev40.5.0b1.dev50.5.0b2.dev100.5.0b2.dev110.5.0b2.dev120.5.0b2.dev90.5.0b3.dev130.5.0b3.dev140.5.0b3.dev170.5.0b3.dev180.5.0b3.dev190.5.0b3.dev200.5.0b3.dev210.5.0b3.dev220.5.0b3.dev240.5.0b3.dev260.5.0b3.dev270.5.0b3.dev280.5.0b3.dev290.5.0b3.dev300.5.0b3.dev310.5.0b3.dev320.5.0b3.dev330.5.0b3.dev34 |
0.5.0b3.dev36 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
huntr.dev/bounties/af3101d7-fea6-463a-b7e4-a48be219e31b
github.com/pyload/pyload/commit/c035714c0596b704b11af0f8a669352f128ad2d9
nvd.nist.gov/vuln/detail/CVE-2023-0227
pypi.org/project/pyload-ng
Left out here: 1 version. The JSON record has them.