← Vulnerability feed

Vulnerability record · CVE-2024-22416 · published 18 January 2024

CVE-2024-22416: Pyload-ng project pyload-ng cross-site request forgery vulnerability

PPyload Ng Project · Pyload Ng

pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

8.8 CVSS 3.1 High EPSS 0.95% · top 40.4% CWE-352 · Cross-site request forgery
8.8CVSS 3.1 base score
0.95%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pyload/pyload/commit/1374c824271cb7e927740664d06d2e577624ca3e Patch
https://github.com/pyload/pyload/commit/c7cdc18ad9134a75222974b39e8b427c4af845fc Patch
https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fm ExploitThird Party Advisory
https://github.com/pyload/pyload/commit/1374c824271cb7e927740664d06d2e577624ca3e Patch
https://github.com/pyload/pyload/commit/c7cdc18ad9134a75222974b39e8b427c4af845fc Patch
https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fm ExploitThird Party Advisory

Track CVE-2024-22416 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-54802Pyload-ng project pyload-ng path traversal vulnerabilitypyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path tra…EPSS 1.2%9.3CVE-2026-35459Pyload-ng project pyload-ng server-side request forgery (ssrf) vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vu…EPSS 0.38%8.8CVE-2026-35463Pyload-ng project pyload-ng os command injection vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restri…EPSS 0.91%8.8CVE-2026-33509Pyload improper privilege management vulnerabilitypyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API e…EPSS 0.58%8.8CVE-2026-33511Pyload insecure direct object reference vulnerabilitypyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator i…EPSS 0.62%8.3CVE-2026-42313Pyload-ng project pyload-ng incorrect authorization vulnerabilitypyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SE…EPSS 0.39%8.1CVE-2026-32808Pyload path traversal vulnerabilitypyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password v…EPSS 0.46%7.7CVE-2026-35187Pyload-ng project pyload-ng server-side request forgery (ssrf) vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api…EPSS 0.37%

Source: NIST National Vulnerability Database (record CVE-2024-22416), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.