CVE-2025-55156: PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter

Severity: high (CVSS 7.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-11 · updated 2026-06-17
Weakness: CWE-89

Description

pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.

Affected products

pyload: before 0.5.0b3.dev91

References

https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271
https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f
https://github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf

Get alerted when CVE-2025-55156 or the next vulnerability affects your stack