← Vulnerability feed

Vulnerability record · CVE-2026-42313 · published 11 May 2026

CVE-2026-42313: Pyload-ng project pyload-ng incorrect authorization vulnerability

PPyload Ng Project · Pyload Ng

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The allowlist contains ("proxy", "username") and ("proxy", "password") — which protect the proxy credentials — but it does not include ("proxy", "enabled"), ("proxy", "host"), ("proxy", "port"), or ("proxy", "type"). Any authenticated user with the non-admin SETTINGS permission can enable proxying and point pyload at any host they control. From that point, every outbound download, captcha fetch, update check, and plugin HTTP call is transparently routed through the attacker. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.

8.3 CVSS 3.1 High EPSS 0.39% · top 69.9% CWE-441 · CWE-441CWE-863 · Incorrect authorization
8.3CVSS 3.1 base score
0.39%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The allowlist contains ("proxy", "username") and ("proxy", "password") — which protect the proxy credentials — but it does not include ("proxy", "enabled"), ("proxy", "host"), ("proxy", "port"), or ("proxy", "type"). Any authenticated user with the non-admin SETTINGS permission can enable proxying and point pyload at any host they control. From that point, every outbound download, captcha fetch, update check, and plugin HTTP call is transparently routed through the attacker. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pyload/pyload/security/advisories/GHSA-pg67-9wjv-mr85 ExploitVendor Advisory
https://github.com/pyload/pyload/security/advisories/GHSA-pg67-9wjv-mr85 ExploitVendor Advisory

Track CVE-2026-42313 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-54802Pyload-ng project pyload-ng path traversal vulnerabilitypyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path tra…EPSS 1.2%9.3CVE-2026-35459Pyload-ng project pyload-ng server-side request forgery (ssrf) vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vu…EPSS 0.38%8.8CVE-2026-35463Pyload-ng project pyload-ng os command injection vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restri…EPSS 0.91%8.8CVE-2026-33509Pyload improper privilege management vulnerabilitypyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API e…EPSS 0.58%8.8CVE-2026-33511Pyload insecure direct object reference vulnerabilitypyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator i…EPSS 0.62%8.8CVE-2024-22416Pyload-ng project pyload-ng cross-site request forgery vulnerabilitypyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since t…EPSS 0.95%8.1CVE-2026-32808Pyload path traversal vulnerabilitypyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password v…EPSS 0.46%7.7CVE-2026-35187Pyload-ng project pyload-ng server-side request forgery (ssrf) vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api…EPSS 0.37%

Source: NIST National Vulnerability Database (record CVE-2026-42313), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.