pyload/pyload Security Advisories | GitStock

high2026-10-09

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

GHSA-68w4-83fh-f2w8

medium2026-10-09

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

GHSA-9q47-3cm2-2rp8

high2026-10-09

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

GHSA-jq7h-wrvp-3rgx

high2026-10-09

pyLoad: Api.set_user_permission never invalidates the target's session

GHSA-889w-m37p-88m5

medium2026-10-09

pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

GHSA-p3pr-8f3m-4qp8

high2026-10-09

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

GHSA-fr26-jjhm-638c

high2026-10-09

pyLoad has an authentication bypass in API key validation (check_apikey cache)

GHSA-r44w-v6gf-x3p6

medium2026-10-09

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

GHSA-j92p-c242-7hfx · CVE-2026-75597

medium2026-10-09

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

GHSA-vq8p-m3wm-gv5f · CVE-2026-48484

medium2026-07-09

pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

GHSA-c2f9-4mc8-j656 · CVE-2026-48987

medium2026-07-09

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

GHSA-m5x5-28jr-gpjj · CVE-2026-48737

medium2026-05-21

pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API

GHSA-8rp3-xc6w-5qp5 · CVE-2026-46561

high2026-05-14

pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal

GHSA-fcjq-435v-jx94 · CVE-2026-45348

medium2026-05-14

pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad

GHSA-w727-595x-pc3r · CVE-2026-45306

medium2026-05-06

PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI

GHSA-c3gc-9pf2-84gg · CVE-2026-44226

high2026-05-05

PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data

GHSA-838g-gr43-qqg9 · CVE-2026-42315

medium2026-05-05

PyLoad Vulnerable to Path Traversal via Package Folder Name

GHSA-97r3-5w84-r4q8 · CVE-2026-42314

high2026-05-04

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

GHSA-pg67-9wjv-mr85 · CVE-2026-42313

medium2026-05-04

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

GHSA-ccxc-x975-4hh9 · CVE-2026-42312

medium2026-04-16

pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

GHSA-mp82-fmj6-f22v · CVE-2026-40594