Pyload vulnerabilities

Products

• Pyload 50
• Pyload/pyload 9

Newest

• pyload pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo CVE-2026-75597 Fix available 5.3 MediumOctober 9, 2026
• pyload pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination CVE-2026-48484 Fix available 6.5 MediumOctober 9, 2026
• pyload pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager CVE-2026-48987 6.5 MediumJuly 9, 2026
• pyload pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs CVE-2026-48737 4.9 MediumJuly 9, 2026
• pyload pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API CVE-2026-46561 Fix available 5.0 MediumMay 21, 2026
• pyload pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal CVE-2026-45348 8.7 HighMay 14, 2026
• pyload pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory CVE-2026-45306 6.5 MediumMay 14, 2026
• pyload pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI CVE-2026-44226 Fix available 5.3 MediumMay 6, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad: Path Traversal via Package Folder Name in set_package_data CVE-2026-42315 Fix available 8.1 HighMay 5, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad: Path Traversal via Package Folder Name CVE-2026-42314 Fix available 6.5 MediumMay 5, 2026
• pyload, pyload-ng project pyload-ng +1 more pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy CVE-2026-42313 Fix available 8.3 HighMay 4, 2026
• pyload, pyload-ng project pyload-ng +1 more pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification CVE-2026-42312 Fix available 6.8 MediumMay 4, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition) CVE-2026-40594 Fix available 4.8 MediumApril 16, 2026
• pyload pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) CVE-2026-41133 8.8 HighApril 14, 2026
• pyload pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions CVE-2026-40071 Fix available 5.4 MediumApril 8, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass CVE-2026-35592 Fix available 5.3 MediumApril 7, 2026
• pyload, pyload-ng project pyload-ng +1 more Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng CVE-2026-35586 Fix available 6.8 MediumApril 7, 2026
• pyload pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution CVE-2026-35464 7.5 HighApril 4, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad has Improper Neutralization of Special Elements used in an OS Command CVE-2026-35463 Fix available 8.8 HighApril 4, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad has SSRF fix bypass via HTTP redirect CVE-2026-35459 9.3 CriticalApril 4, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter CVE-2026-35187 7.7 HighApril 4, 2026
• pyload pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVE-2026-33992 9.3 CriticalMarch 27, 2026
• pyload, pyload-ng project pyload-ng +1 more pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad CVE-2026-33511 8.8 HighMarch 24, 2026
• pyload, pyload-ng project pyload-ng +1 more pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration CVE-2026-33509 7.5 HighMarch 20, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification CVE-2026-32808 8.1 HighMarch 20, 2026
• pyload, pyload-ng project pyload-ng +1 more pyload-ng: Improper Authentication and Origin Validation Error CVE-2026-33314 Fix available 6.5 MediumMarch 19, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad: Arbitrary File Write via Path Traversal in edit_package() CVE-2026-29778 Fix available 7.1 HighMarch 5, 2026
• pyload pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters CVE-2025-61773 Fix available 8.1 HighOctober 9, 2025
• pyload Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs CVE-2025-57751 Fix available 7.7 HighAugust 21, 2025
• pyload PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter CVE-2025-55156 Fix available 7.8 HighAugust 11, 2025
• pyload, pyload-ng project pyload-ng +1 more pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVE-2025-54802 Fix available 9.8 CriticalAugust 4, 2025
• pyload pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write CVE-2025-54140 Fix available 7.5 HighJuly 21, 2025
• pyload pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVE-2025-53890 Fix available 9.8 CriticalJuly 14, 2025
• pyload pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages CVE-2025-7346 8.7 HighJuly 8, 2025
• pyload, pyload pyload/pyload, payload +2 more Open Redirection in pyload/pyload CVE-2024-1240 Fix available 4.6 MediumNovember 15, 2024
• pyload pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API CVE-2024-47821 Fix available 9.1 CriticalOctober 25, 2024
• pyload pyLoad allows upload to arbitrary folder lead to RCE CVE-2024-32880 9.1 CriticalApril 24, 2024
• pyload pyLoad open redirect vulnerability due to improper validation of the is_safe_url function CVE-2024-24808 Fix available 4.7 MediumFebruary 5, 2024
• pyload, pyload-ng project pyload-ng +1 more Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation CVE-2024-22416 Public exploitFix available 9.7 CriticalJanuary 17, 2024
• pyload pyLoad unauthenticated flask configuration leakage CVE-2024-21644 Public exploitFix available EPSS 42.4% 7.5 HighJanuary 8, 2024
• pyload pyLoad Log Injection CVE-2024-21645 Fix available EPSS 24.7% 5.3 MediumJanuary 8, 2024
• pyload Download to arbitrary folder can lead to RCE CVE-2023-47890 Fix available 8.8 HighNovember 21, 2023
• pyload, pyload pyload/pyload, pyload-ng project pyload-ng +2 more Improper Certificate Validation in pyload/pyload CVE-2023-0509 Fix available 7.4 HighJanuary 26, 2023
• pyload, pyload pyload/pyload, pyload-ng project pyload-ng +2 more Cross-site Scripting (XSS) - Stored in pyload/pyload CVE-2023-0488 Fix available 9.6 CriticalJanuary 26, 2023
• pyload, pyload pyload/pyload +1 more Excessive Attack Surface in pyload/pyload CVE-2023-0435 Fix available 4.0 MediumJanuary 22, 2023
• pyload, pyload pyload/pyload +1 more Improper Input Validation in pyload/pyload CVE-2023-0434 Fix available 5.4 MediumJanuary 22, 2023
• pyload, pyload pyload/pyload +1 more Code Injection in pyload/pyload CVE-2023-0297 Public exploitFix available EPSS 95.9% 9.8 CriticalJanuary 14, 2023
• pyload, pyload pyload/pyload +1 more Insufficient Session Expiration in pyload/pyload CVE-2023-0227 Fix available 8.3 HighJanuary 12, 2023
• pyload, pyload pyload/pyload, pyload-ng project pyload-ng +2 more Improper Restriction of Rendered UI Layers or Frames in pyload/pyload CVE-2023-0057 Fix available 3.1 LowJanuary 5, 2023
• pyload, pyload pyload/pyload +1 more Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload CVE-2023-0055 Fix available 3.1 LowJanuary 4, 2023