Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pyload-ng

50 known vulnerabilities (10 critical, 18 high, 20 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
0.5.0b3.dev102 (Oct 28, 2026): affected by 5 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
50 · 10 critical, 18 high, 20 medium, 2 low
Weekly downloads
1,558
Dependents
1
Releases
107 since 0.5.0a5.dev528 (Jun 11, 2019)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • GHSA-P3PR-8F3M-4QP8
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev101 (0.5.0b3.dev102 is outside it)
  • CVE-2026-75597
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev100 (0.5.0b3.dev101 is outside it)
  • CVE-2026-48484
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev100 (0.5.0b3.dev101 is outside it)
  • CVE-2026-48987
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev100 (0.5.0b3.dev101 is outside it)
  • CVE-2026-48737
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev100 (0.5.0b3.dev101 is outside it)
  • CVE-2026-45306
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it)
  • CVE-2026-45348
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it)
  • CVE-2026-46561
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it)
  • CVE-2026-44226
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it)
  • CVE-2026-42315
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it)
  • CVE-2026-42314
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it)
  • CVE-2026-42312
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it)
Show all 50 advisoriesShow fewer advisories
  • CVE-2026-42313
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev99 (0.5.0b3.dev100 is outside it)
  • CVE-2026-41133
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev97 (0.5.0b3.dev98 is outside it)
  • CVE-2026-40594
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev97 (0.5.0b3.dev98 is outside it)
  • CVE-2026-40071
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it)
  • CVE-2026-35592
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it)
  • CVE-2026-35586
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it)
  • CVE-2026-35464
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev102 (through the newest release)
  • CVE-2026-35463
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it)
  • CVE-2026-35459
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it)
  • CVE-2026-35187
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it)
  • CVE-2026-33992
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it)
  • CVE-2026-33509
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it)
  • CVE-2026-33314
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it)
  • CVE-2026-29778
    Affects 0.5.0b3.dev13 to 0.5.0b3.dev96 (0.5.0b3.dev97 is outside it)
  • CVE-2025-61773
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev90 (0.5.0b3.dev91 is outside it)
  • CVE-2025-57751
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev91 (0.5.0b3.dev92 is outside it)
  • CVE-2025-55156
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev90 (0.5.0b3.dev91 is outside it)
  • CVE-2025-54802
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev89 (0.5.0b3.dev90 is outside it)
  • CVE-2025-54140
    Affects 0.5.0b3.dev89 (0.5.0b3.dev90 is outside it)
  • CVE-2025-53890
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev102 (through the newest release)
  • CVE-2025-7346
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev88 (0.5.0b3.dev89 is outside it)
  • CVE-2024-1240
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev102 (through the newest release)
  • CVE-2024-39205
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev85 (0.5.0b3.dev87 is outside it)
  • CVE-2024-47821
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev102 (through the newest release)
  • CVE-2024-32880
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev102 (through the newest release)
  • CVE-2024-24808
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev78 (0.5.0b3.dev79 is outside it)
  • CVE-2024-22416
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev77 (0.5.0b3.dev78 is outside it)
  • CVE-2024-21644
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev76 (0.5.0b3.dev77 is outside it)
  • CVE-2024-21645
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev76 (0.5.0b3.dev77 is outside it)
  • CVE-2023-47890
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev74 (0.5.0b3.dev75 is outside it)
  • CVE-2023-0509
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev43 (0.5.0b3.dev44 is outside it)
  • CVE-2023-0488
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev41 (0.5.0b3.dev42 is outside it)
  • CVE-2023-0435
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev40 (0.5.0b3.dev41 is outside it)
  • CVE-2023-0434
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev39 (0.5.0b3.dev40 is outside it)
  • CVE-2023-0297
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev30 (0.5.0b3.dev31 is outside it)
  • CVE-2023-0227
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev35 (0.5.0b3.dev38 is outside it)
  • CVE-2023-0057
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev32 (0.5.0b3.dev33 is outside it)
  • CVE-2023-0055
    Affects 0.5.0a5.dev528 to 0.5.0b3.dev31 (0.5.0b3.dev32 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 50

  • pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

    Affected: through 0.5.0b3.dev101.

    No fix released.

  • CVE-2026-75597Medium 5.3

    pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

    Affected: fixed in 0.5.0b3.dev101.

    Fixed in 0.5.0b3.dev101 (released Jul 9, 2026, 92 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2026-48484Medium 6.5

    pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

    Affected: fixed in 0.5.0b3.dev101.

    Fixed in 0.5.0b3.dev101 (released Jul 9, 2026, 92 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2026-48987Medium 6.5

    pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

    Affected: through 0.5.0b3.dev100.

    No fix released.

  • CVE-2026-48737Medium 4.9

    pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

    Affected: through 0.5.0b3.dev100.

    No fix released.

  • CVE-2026-45306Medium 6.5

    pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory

    Affected: through 0.5.0b3.dev99.

    No fix released.

  • pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal

    Affected: through 0.5.0b3.dev99.

    No fix released.

  • CVE-2026-46561Medium 5.0

    pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API

    Affected: fixed in 0.5.0b3.dev100.

    Fixed in 0.5.0b3.dev100 (released May 17, 2026, 11 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2026-44226Medium 5.3

    pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI

    Affected: fixed in 0.5.0b3.dev100.

    Fixed in 0.5.0b3.dev100 (released May 17, 2026, 6 days after disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • pyLoad: Path Traversal via Package Folder Name in set_package_data

    Affected: fixed in 0.5.0b3.dev100.

    Fixed in 0.5.0b3.dev100 (released May 17, 2026, 6 days after disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2026-42314Medium 6.5

    pyLoad: Path Traversal via Package Folder Name

    Affected: fixed in 0.5.0b3.dev100.

    Fixed in 0.5.0b3.dev100 (released May 17, 2026, 6 days after disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2026-42312Medium 6.8

    pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification

    Affected: fixed in 0.5.0b3.dev100.

    Fixed in 0.5.0b3.dev100 (released May 17, 2026, 6 days after disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy

    Affected: fixed in 0.5.0b3.dev100.

    Fixed in 0.5.0b3.dev100 (released May 17, 2026, 6 days after disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

    Affected: through 0.5.0b3.dev97.

    No fix released.

  • CVE-2026-40594Medium 4.8

    pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

    Affected: fixed in 0.5.0b3.dev98; fixed in 0.5.0b3.dev69.

    Fixed in 0.5.0b3.dev98 (released Apr 15, 2026, 6 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

Show all 50 advisoriesShow fewer advisories
  • CVE-2026-40071Medium 5.4

    pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions

    Affected: fixed in 0.5.0b3.dev97.

    Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, 2 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2026-35592Medium 5.3

    pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass

    Affected: fixed in 0.5.0b3.dev97.

    Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, the day of disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2026-35586Medium 6.8

    Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

    Affected: fixed in 0.5.0b3.dev97.

    Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, the day of disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code…

    Affected: through 0.5.0b3.

    No fix released. The latest release, 0.5.0b3.dev102, is still affected.

  • pyLoad has Improper Neutralization of Special Elements used in an OS Command

    Affected: fixed in 0.5.0b3.dev97; through 0.5.0b3.dev96.

    Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, the day of disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2026-35459Critical 9.3

    pyLoad has SSRF fix bypass via HTTP redirect

    Affected: through 0.5.0b3.dev96.

    No fix released.

  • pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter

    Affected: through 0.5.0b3.dev96.

    No fix released.

  • CVE-2026-33992Critical 9.3

    pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

    Affected: through 0.5.0b3.dev96.

    No fix released.

  • pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

    Affected: from 0.4.0, through 0.5.0b3.dev96.

    No fix released.

  • CVE-2026-33314Medium 6.5

    pyload-ng: Improper Authentication and Origin Validation Error

    Affected: fixed in 0.5.0b3.dev97.

    Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, 14 days after disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • pyLoad: Arbitrary File Write via Path Traversal in edit_package()

    Affected: from 0.5.0b3.dev13, fixed in 0.5.0b3.dev97.

    Fixed in 0.5.0b3.dev97 (released Apr 7, 2026, 31 days after disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters

    Affected: fixed in 0.5.0b3.dev91.

    Fixed in 0.5.0b3.dev91 (released Aug 9, 2025, 61 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

    Affected: fixed in 0.5.0b3.dev92.

    Fixed in 0.5.0b3.dev92 (released Aug 21, 2025, the day of disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter

    Affected: fixed in 0.5.0b3.dev91.

    Fixed in 0.5.0b3.dev91 (released Aug 9, 2025, 2 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2025-54802Critical 9.8

    pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)

    Affected: fixed in 0.5.0b3.dev90.

    Fixed in 0.5.0b3.dev90 (released Aug 2, 2025, 3 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write

    Affected: from 0.5.0b3.dev89, fixed in 0.5.0b3.dev90.

    Fixed in 0.5.0b3.dev90 (released Aug 2, 2025, 11 days after disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2025-53890Critical 9.8

    pyLoad vulnerable to remote code execution through js2py onCaptchaResult

    Affected: fixed in 0.20.

    No fix released. The advisory names 0.20 as the fix, which the registry doesn't have yet. The latest release, 0.5.0b3.dev102, is still affected.

  • Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages

    Affected: through 0.5.0b3.dev88.

    No fix released.

  • CVE-2024-1240Medium 4.6

    Open Redirection in pyload/pyload

    Affected: all versions.

    No fix released. The latest release, 0.5.0b3.dev102, is still affected.

  • CVE-2024-39205Critical 9.8

    An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP…

    Affected: through 0.5.0b3.dev85.

    No fix released.

  • CVE-2024-47821Critical 9.1

    pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

    Affected: fixed in 0.5.0b3.dev87; through 0.5.0.

    No fix released. The latest release, 0.5.0b3.dev102, is still affected.

  • CVE-2024-32880Critical 9.1

    pyLoad allows upload to arbitrary folder lead to RCE

    Affected: through 0.5.0.

    No fix released. The latest release, 0.5.0b3.dev102, is still affected.

  • CVE-2024-24808Medium 4.7

    pyLoad open redirect vulnerability due to improper validation of the is_safe_url function

    Affected: fixed in 0.5.0b3.dev79.

    Fixed in 0.5.0b3.dev79 (released Feb 5, 2024, 1 day before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2024-22416Critical 9.7

    Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

    Affected: fixed in 0.5.0b3.dev78.

    Fixed in 0.5.0b3.dev78 (released Jan 17, 2024, the day of disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • pyLoad unauthenticated flask configuration leakage

    Affected: fixed in 0.5.0b3.dev77.

    Fixed in 0.5.0b3.dev77 (released Jan 6, 2024, 2 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2024-21645Medium 5.3

    pyLoad Log Injection

    Affected: fixed in 0.5.0b3.dev77.

    Fixed in 0.5.0b3.dev77 (released Jan 6, 2024, 2 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.

    Affected: fixed in 0.5.0b3.dev75.

    Fixed in 0.5.0b3.dev75 (released Nov 21, 2023, 48 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • Improper Certificate Validation in pyload/pyload

    Affected: fixed in 0.5.0b3.dev44.

    Fixed in 0.5.0b3.dev44 (released Jan 26, 2023, the day of disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2023-0488Critical 9.6

    Cross-site Scripting (XSS) - Stored in pyload/pyload

    Affected: fixed in 0.5.0b3.dev42.

    Fixed in 0.5.0b3.dev42 (released Jan 25, 2023, 1 day before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2023-0435Medium 4.0

    Excessive Attack Surface in pyload/pyload

    Affected: fixed in 0.5.0b3.dev41.

    Fixed in 0.5.0b3.dev41 (released Jan 22, 2023, the day of disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2023-0434Medium 5.4

    Improper Input Validation in pyload/pyload

    Affected: fixed in 0.5.0b3.dev40.

    Fixed in 0.5.0b3.dev40 (released Jan 21, 2023, 1 day before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • CVE-2023-0297Critical 9.8

    Code Injection in pyload/pyload

    Affected: fixed in 0.5.0b3.dev31.

    Fixed in 0.5.0b3.dev31 (released Jan 3, 2023, 11 days before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • Insufficient Session Expiration in pyload/pyload

    Affected: fixed in 0.5.0b3.dev36.

    No fix released. The advisory names 0.5.0b3.dev36 as the fix, which the registry doesn't have yet.

  • Improper Restriction of Rendered UI Layers or Frames in pyload/pyload

    Affected: fixed in 0.5.0b3.dev33.

    Fixed in 0.5.0b3.dev33 (released Jan 4, 2023, 1 day before disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.

  • Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload

    Affected: fixed in 0.5.0b3.dev32.

    Fixed in 0.5.0b3.dev32 (released Jan 4, 2023, the day of disclosure).

    The latest release, 0.5.0b3.dev102, is not affected.