CVE-2023-47890
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
pyLoad 0.5.0 is vulnerable to unrestricted file upload, allowing an attacker to upload arbitrary files to the server without proper validation.
Risk Assessment
The risk involves potential remote code execution or server compromise through malicious file uploads, leading to data confidentiality and integrity breaches.
Recommendation
Immediately update pyLoad to the latest version and implement file type and size validation mechanisms.
Other vulnerabilities in pyLoad
See all- CVE-2026-42315High
In pyLoad prior to version 0.5.0b3.dev100, there is a vulnerability that allows a user with Perms.MODIFY to specify arbitrary directories as download locations for a package through the set_package_data() API function. The lack of sanitization in the '_folder' key enables this action.
- CVE-2026-42313High
In pyLoad prior to version 0.5.0b3.dev100, the set_config_value() API method improperly managed security-sensitive options, allowing authenticated users with SETTINGS permission to enable proxying and route traffic through a host they control.
- CVE-2026-35459Critical
pyLoad in version 0.5.0b3.dev96 and earlier has an SSRF vulnerability. The fix for CVE-2026-33992 added IP validation, but pycurl automatically follows HTTP redirects and redirect targets are not validated. An authenticated user with ADD permission can bypass the SSRF filter by using a URL that redirects to an internal address.
- CVE-2026-35187High
In pyLoad 0.5.0b3.dev96 and earlier, the parse_urls API function fetches arbitrary URLs server-side without validation. An authenticated user with ADD permission can read internal resources, local files (file://), and use gopher:// and dict:// protocols.
Original NVD description (English source)
pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.