CVE-2026-42313
HighSummary
In pyLoad prior to version 0.5.0b3.dev100, the set_config_value() API method improperly managed security-sensitive options, allowing authenticated users with SETTINGS permission to enable proxying and route traffic through a host they control.
Risk Assessment
The organization may be exposed to data interception and man-in-the-middle attacks, potentially leading to loss of confidentiality.
Recommendation
It is recommended to update pyLoad to version 0.5.0b3.dev100 or later to mitigate this vulnerability and review user permissions in the system.
Other vulnerabilities in pyLoad
See all- CVE-2026-42315High
In pyLoad prior to version 0.5.0b3.dev100, there is a vulnerability that allows a user with Perms.MODIFY to specify arbitrary directories as download locations for a package through the set_package_data() API function. The lack of sanitization in the '_folder' key enables this action.
- CVE-2026-35459Critical
pyLoad in version 0.5.0b3.dev96 and earlier has an SSRF vulnerability. The fix for CVE-2026-33992 added IP validation, but pycurl automatically follows HTTP redirects and redirect targets are not validated. An authenticated user with ADD permission can bypass the SSRF filter by using a URL that redirects to an internal address.
- CVE-2026-35187High
In pyLoad 0.5.0b3.dev96 and earlier, the parse_urls API function fetches arbitrary URLs server-side without validation. An authenticated user with ADD permission can read internal resources, local files (file://), and use gopher:// and dict:// protocols.
- CVE-2023-47890High
pyLoad 0.5.0 is vulnerable to unrestricted file upload, allowing an attacker to upload arbitrary files to the server without proper validation.
Original NVD description (English source)
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The allowlist contains ("proxy", "username") and ("proxy", "password") — which protect the proxy credentials — but it does not include ("proxy", "enabled"), ("proxy", "host"), ("proxy", "port"), or ("proxy", "type"). Any authenticated user with the non-admin SETTINGS permission can enable proxying and point pyload at any host they control. From that point, every outbound download, captcha fetch, update check, and plugin HTTP call is transparently routed through the attacker. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.