Security Flaw in pyLoad Download Manager Exposing Proxy Settings
CVE-2026-42313

8.3HIGH

Key Information:

Vendor

Pyload

Status
Pyload
Vendor
CVE Published:
11 May 2026

What is CVE-2026-42313?

pyLoad, a popular open-source download manager, is susceptible to an access control issue whereby authenticated users lacking administrative privileges can improperly modify sensitive proxy configuration settings. Specifically, the set_config_value() API method does not sufficiently restrict the options available to non-admin users, allowing them to enable proxying and redirect outbound connections through any host they control. This means that malicious users could intercept downloads, updates, and plugin communications by leveraging proxy features, thereby compromising user security. The vulnerability has been addressed in version 0.5.0b3.dev100, following previous fixes that targeted related configurations.

Affected Version(s)

pyload < 0.5.0b3.dev100

References

https://github.com/pyload/pyload/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.