CVE-2026-33511

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33511
pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows unauthenticated remote users to access localhost-restricted endpoints, enabling them to inject arbitrary downloads, write files to the storage directory, and execute JavaScript code. This issue has been patched in version 0.5.0b3.dev97.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw Exploit Mitigation Vendor Advisory
https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw Exploit Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*
cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:*
History

26 Mar 2026, 20:29

Type Values Removed Values Added
CPE cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:*
cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
Summary
  • (es) pyLoad es un gestor de descargas gratuito y de código abierto escrito en Python. Desde la versión 0.4.20 hasta antes de la versión 0.5.0b3.dev97, el decorador local_check en la función ClickNLoad de pyLoad puede ser eludido por cualquier atacante remoto mediante la suplantación del encabezado Host HTTP. Esto permite a usuarios remotos no autenticados acceder a puntos finales restringidos a localhost, permitiéndoles inyectar descargas arbitrarias, escribir archivos en el directorio de almacenamiento y ejecutar código JavaScript. Este problema ha sido parcheado en la versión 0.5.0b3.dev97.
References () https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw - () https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw - Exploit, Mitigation, Vendor Advisory
First Time Pyload
Pyload-ng Project
Pyload-ng Project pyload-ng
Pyload pyload

25 Mar 2026, 15:16

Type Values Removed Values Added
References () https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw - () https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw -

24 Mar 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-24 20:16

Updated : 2026-03-26 20:29

NVD link : CVE-2026-33511

Mitre link : CVE-2026-33511

CVE.ORG link : CVE-2026-33511

JSON object : View

Products Affected

pyload-ng_project

  • pyload-ng

pyload

  • pyload
CWE
CWE-639

Authorization Bypass Through User-Controlled Key