pyLoad vulnerabilities

In pyLoad prior to version 0.5.0b3.dev100, there is a vulnerability that allows a user with Perms.MODIFY to specify arbitrary directories as download locations for a package through the set_package_data() API function. The lack of sanitization in the '_folder' key enables this action.

In pyLoad prior to version 0.5.0b3.dev100, the set_config_value() API method improperly managed security-sensitive options, allowing authenticated users with SETTINGS permission to enable proxying and route traffic through a host they control.

pyLoad in version 0.5.0b3.dev96 and earlier has an SSRF vulnerability. The fix for CVE-2026-33992 added IP validation, but pycurl automatically follows HTTP redirects and redirect targets are not validated. An authenticated user with ADD permission can bypass the SSRF filter by using a URL that redirects to an internal address.

In pyLoad 0.5.0b3.dev96 and earlier, the parse_urls API function fetches arbitrary URLs server-side without validation. An authenticated user with ADD permission can read internal resources, local files (file://), and use gopher:// and dict:// protocols.

pyLoad 0.5.0 is vulnerable to unrestricted file upload, allowing an attacker to upload arbitrary files to the server without proper validation.