← CVE Intelligence

CVE-2026-33511

pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad PUBLISHED

Description (CNA)

pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows unauthenticated remote users to access localhost-restricted endpoints, enabling them to inject arbitrary downloads, write files to the storage directory, and execute JavaScript code. This issue has been patched in version 0.5.0b3.dev97.

Affected (CNA)

Vendor / productVersions
pyload / pyloadaffected >= 0.4.20, < 0.5.0b3.dev97

CWE

CWE-639

References

ADP enrichment

CISA-ADP

No English description supplied.