CVE-2026-33511

Опубликовано: 24 мар. 2026

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows unauthenticated remote users to access localhost-restricted endpoints, enabling them to inject arbitrary downloads, write files to the storage directory, and execute JavaScript code. This issue has been patched in version 0.5.0b3.dev97.

Ссылки

https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw
Exploit
Mitigation
Vendor Advisory
https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw
Exploit
Mitigation
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*

Версия до 0.4.20 (включая)

cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:*

Версия от 0.5.0a5.dev528 (включая) до 0.5.0b3.dev97 (исключая)

EPSS

Процентиль: 35%

0.00422

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-639

Связанные уязвимости