TI-2025-38166 Aliases CVE-2025-61773 GHSA-cjjf-27cc-pvmv

pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters

HIGH 70CWE-116Published 2025-10-09 · Updated 2025-10-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting, Code execution
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-94.

Summary

pyLoad is a free and open-source download manager written in Python. In versions prior to 0.5.0b3.dev91, pyLoad web interface contained insufficient input validation in both the Captcha script endpoint and the Click'N'Load (CNL) Blueprint. This flaw allowed untrusted user input to be processed unsafely, which could be exploited by an attacker to inject arbitrary content into the web UI or manipulate request handling. The vulnerability could lead to client-side code execution (XSS) or other unintended behaviors when a malicious payload is submitted. user-supplied parameters from HTTP requests were not adequately validated or sanitized before being passed into the application logic and response generation. This allowed crafted input to alter the expected execution flow. CNL (Click'N'Load) blueprint exposed unsafe handling of untrusted parameters in HTTP requests. The application did not consistently enforce input validation or encoding, making it possible for an attacker to craft malicious requests. Version 0.5.0b3.dev91 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00517 44th percentileScored 2026-11-07

Fix Fixed pyload (pyload): 0.5.0b3.dev91pyload-ng (PyPI): 0.5.0b3.dev91

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pyload	pyload	before 0.5.0b3.dev91	0.5.0b3.dev91	Patch available	CNA
—	pyload-ng (PyPI)	before 0.5.0b3.dev91	0.5.0b3.dev91	Patch available	GHSA-cjjf-27cc-pvmv

pyload Vendorpyload Affected before 0.5.0b3.dev91 Fixed in 0.5.0b3.dev91 Patch available CNA
pyload-ng (PyPI) Vendor— Affected before 0.5.0b3.dev91 Fixed in 0.5.0b3.dev91 Patch available GHSA-cjjf-27cc-pvmv

Remediation

Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev91
Fix · GHSA-cjjf-27cc-pvmv pyload-ng (PyPI) Fixed in 0.5.0b3.dev91 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-61773
2026-10-03 Alias added: GHSA-cjjf-27cc-pvmv

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-61773

Other 4

TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
TI-2025-34556 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
TI-2025-33765 pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVSS 3.1CRITICAL 9.8
TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
TI-2026-27589 pyLoad has SSRF fix bypass via HTTP redirect CVSS 4.0CRITICAL 9.3
TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3

See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences