Pyload vulnerabilities
53 CVEs and advisories name Pyload as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-123816pyLoad: Authentication bypass in API key validation (check_apikey cache)
- CVE-2026-123815pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
- CVE-2026-123814pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
- CVE-2026-123813pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
- CVE-2026-75597pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
- CVE-2026-48484pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
- CVE-2026-48987pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager
- CVE-2026-48737pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs
- CVE-2026-45306pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory
- CVE-2026-45348pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal
- CVE-2026-46561pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API
- CVE-2026-44226pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI
- CVE-2026-42315pyLoad: Path Traversal via Package Folder Name in set_package_data
- CVE-2026-42314pyLoad: Path Traversal via Package Folder Name
- CVE-2026-42312pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification
- CVE-2026-42313pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy
- CVE-2026-41133pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
- CVE-2026-40594pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
- CVE-2026-40071pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions
- CVE-2026-35592pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass
- CVE-2026-35586Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng
- CVE-2026-35464pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution
- CVE-2026-35463pyLoad has Improper Neutralization of Special Elements used in an OS Command
- CVE-2026-35459pyLoad has SSRF fix bypass via HTTP redirect
- CVE-2026-35187pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter
- CVE-2026-33992pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
- CVE-2026-33511pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad
- CVE-2026-33509pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
- CVE-2026-33314pyload-ng: Improper Authentication and Origin Validation Error
- CVE-2026-32808pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification