Is CVE-2025-7346 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-7346 being exploited in the wild.

How severe is CVE-2025-7346?

High severity, with a CVSS score of 7.5, published 8 July 2025.

Which products and versions are affected?

pyload-ng (PyPI) <= 0.5.0b3.dev88, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev88.

Is there a fix for CVE-2025-7346?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-7346 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-7346?

Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-7346: pyLoad authentication bypass via Host header spoofing in local_check

Q: Which products and versions are affected?

pyload-ng (PyPI) <= 0.5.0b3.dev88, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev88.

Q: Is there a fix for CVE-2025-7346?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-7346 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-7346?

Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-7346 · Severity: high · CVSS 7.5 · Published 2025-07-08

pyLoad, a popular open-source download manager, is vulnerable to an authentication bypass. An unauthorized attacker can trick the system into thinking a request is coming from the local server itself by manipulating network headers. This allows the attacker to perform administrative actions, such as creating arbitrary download packages, without needing a username or password.

Technologies: pyload-ng (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-7346 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-7346 being exploited in the wild.
How severe is CVE-2025-7346?: High severity, with a CVSS score of 7.5, published 8 July 2025.
Which products and versions are affected?: pyload-ng (PyPI) <= 0.5.0b3.dev88, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev88.
Is there a fix for CVE-2025-7346?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-7346 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-7346?: Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in pyLoad's 'local_check' middleware allows for an authentication bypass via Host header spoofing. The middleware validates whether a request is local by checking if the 'REMOTE_ADDR' is a loopback address or if the 'HTTP_HOST' header matches '127.0.0.1:9666' or '[::1]:9666'. Because the 'Host' header is user-controlled, a remote attacker can set this header to bypass the check. This grants access to restricted routes such as '/flash/add', enabling the creation of arbitrary download packages. The issue is tracked as CVE-2025-7346 and affects versions up to 0.5.0b3.dev88.

Affected products

pyLoad pyload-ng <= 0.5.0b3.dev88

Identifiers

CVE-2025-7346
GHSA-x698-5hjm-w2m5
PYSEC-2026-1822

Timeline

2025-07-07: disclosed
2025-07-08: advisory: GHSA-x698-5hjm-w2m5 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.