CVE-2026-33511: pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-24 · updated 2026-06-17
Weakness: CWE-639

Description

pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows unauthenticated remote users to access localhost-restricted endpoints, enabling them to inject arbitrary downloads, write files to the storage directory, and execute JavaScript code. This issue has been patched in version 0.5.0b3.dev97.

Affected products

pyload/pyload: through 0.4.20
pyload: from 0.5.0a5.dev528 before 0.5.0b3.dev97 — fixed in 0.5.0b3.dev97

How to fix

Upgrade to a fixed version: pyload 0.5.0b3.dev97. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33511 or the next vulnerability affects your stack