HTTP Host Header Spoofing in pyLoad Download Manager Bypassing Security Measures
CVE-2026-33511

8.8HIGH

Key Information:

Vendor

Pyload

Status
Pyload
Vendor
CVE Published:
24 March 2026

What is CVE-2026-33511?

A vulnerability in the pyLoad download manager allows remote attackers to bypass the local_check decorator in the ClickNLoad feature by spoofing the HTTP Host header. This bypass permits unauthenticated remote users to access endpoints restricted to localhost, facilitating the injection of arbitrary downloads, unauthorized file writes to the storage directory, and the execution of JavaScript code. Users are advised to upgrade to version 0.5.0b3.dev97, which contains the patch to mitigate this issue.

Affected Version(s)

pyload >= 0.4.20, < 0.5.0b3.dev97

References

https://github.com/pyload/pyload/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.