Read the docs
TI-2026-30621 Aliases CVE-2026-42313GHSA-pg67-9wjv-mr85

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy

Priority HIGH 71CWE-441Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The allowlist contains ("proxy", "username") and ("proxy", "password") — which protect the proxy credentials — but it does not include ("proxy", "enabled"), ("proxy", "host"), ("proxy", "port"), or ("proxy", "type"). Any authenticated user with the non-admin SETTINGS permission can enable proxying and point pyload at any host they control. From that point, every outbound download, captcha fetch, update check, and plugin HTTP call is transparently routed through the attacker. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00396 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pyload (pyload): 0.5.0b3.dev100pyload-ng (PyPI): 0.5.0b3.dev100

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pyloadpyloadbefore 0.5.0b3.dev1000.5.0b3.dev100Patch availableCNA
—pyload-ng (PyPI)before 0.5.0b3.dev1000.5.0b3.dev100Patch availableGHSA-pg67-9wjv-mr85
  • pyload Vendorpyload Affected before 0.5.0b3.dev100 Fixed in 0.5.0b3.dev100 Patch available CNA
  • pyload-ng (PyPI) Vendor— Affected before 0.5.0b3.dev100 Fixed in 0.5.0b3.dev100 Patch available GHSA-pg67-9wjv-mr85

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:*before 0.5.0b3.dev100VulnerablePyload-ng Project
  • cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:* Versions before 0.5.0b3.dev100 Vulnerable ·Pyload-ng Project

Remediation

  • Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev100
  • Fix · GHSA-pg67-9wjv-mr85 pyload-ng (PyPI) Fixed in 0.5.0b3.dev100 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42313
  2. 2026-10-03 Alias added: GHSA-pg67-9wjv-mr85

References

Exploit 1

Advisory 5

Other 2

  • TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2025-34556 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
  • TI-2025-33765 pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVSS 3.1CRITICAL 9.8
  • TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2026-27589 pyLoad has SSRF fix bypass via HTTP redirect CVSS 4.0CRITICAL 9.3
  • TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences