pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The option ("general", "ssl_verify") is not on that allowlist. Any authenticated user with the non-admin SETTINGS permission can set general.ssl_verify = off, and every subsequent outbound pycurl request is made with SSL_VERIFYPEER=0 and SSL_VERIFYHOST=0 — TLS peer and hostname verification are fully disabled. An on-path attacker can then present forged certificates for any hostname pyload fetches. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.
References
| Link | Resource |
|---|---|
| https://github.com/pyload/pyload/security/advisories/GHSA-ccxc-x975-4hh9 | Exploit Vendor Advisory |
| https://github.com/pyload/pyload/security/advisories/GHSA-ccxc-x975-4hh9 | Exploit Vendor Advisory |
Configurations
History
15 May 2026, 14:09
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:* | |
| References | () https://github.com/pyload/pyload/security/advisories/GHSA-ccxc-x975-4hh9 - Exploit, Vendor Advisory | |
| First Time |
Pyload-ng Project pyload-ng
Pyload-ng Project |
11 May 2026, 20:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/pyload/pyload/security/advisories/GHSA-ccxc-x975-4hh9 - |
11 May 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-11 18:16
Updated : 2026-05-15 14:09
NVD link : CVE-2026-42312
Mitre link : CVE-2026-42312
CVE.ORG link : CVE-2026-42312
JSON object : View
Products Affected
pyload-ng_project
- pyload-ng