CVE-2026-33511

pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad

State: Published
Severity: 8.8 High
Published: Mar 24, 2026
Updated: Mar 25, 2026
Reserved: Mar 20, 2026

Description

pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows unauthenticated remote users to access localhost-restricted endpoints, enabling them to inject arbitrary downloads, write files to the storage directory, and execute JavaScript code. This issue has been patched in version 0.5.0b3.dev97.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:L/SA:N	GitHub_M

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
pyloadpyload	>= 0.4.20, < 0.5.0b3.dev97Affected

References

https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.