Is CVE-2026-33314 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33314 being exploited in the wild.

How severe is CVE-2026-33314?

Medium severity, with a CVSS score of 6.5, published 19 March 2026.

Which products and versions are affected?

pyload-ng (PyPI) <= 0.5.0b3.dev96, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev97.

Is there a fix for CVE-2026-33314?

Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev97 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33314 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33314?

Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33314: pyload-ng auth bypass via Host header spoofing in Click'N'Load API

Q: Which products and versions are affected?

pyload-ng (PyPI) <= 0.5.0b3.dev96, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev97.

Q: Is there a fix for CVE-2026-33314?

Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev97 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33314 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-33314?

Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33314 · Severity: medium · CVSS 6.5 · Published 2026-03-19

A security flaw in pyload-ng, a popular download management tool, allows remote attackers to bypass security checks intended to restrict certain features to local users. By tricking the system into thinking a request is coming from the local machine, an attacker can remotely add unauthorized files to the download queue. This can lead to the server being used to attack other systems or being overwhelmed by massive, unwanted downloads.

Technologies: pyload-ng (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-33314 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33314 being exploited in the wild.
How severe is CVE-2026-33314?: Medium severity, with a CVSS score of 6.5, published 19 March 2026.
Which products and versions are affected?: pyload-ng (PyPI) <= 0.5.0b3.dev96, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev97.
Is there a fix for CVE-2026-33314?: Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev97 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33314 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33314?: Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyload-ng (PyPI): upgrade to 0.5.0b3.dev97 or later
```
pip install "pyload-ng>=0.5.0b3.dev97"
```

Technical details

A Host Header Spoofing vulnerability exists in the `@local_check` decorator within `src/pyload/webui/app/blueprints/cnl_blueprint.py`. The implementation incorrectly trusts the user-controlled `HTTP_HOST` header to verify if a request originated from localhost. An unauthenticated remote attacker can bypass this check by providing a spoofed header (e.g., `Host: 127.0.0.1:9666`), gaining access to protected Click'N'Load API endpoints such as `/flash/add`. This allows attackers to perform Server-Side Request Forgery (SSRF) by queuing arbitrary URLs or cause a Denial of Service (DoS) by exhausting disk space and bandwidth. The issue is fixed in version 0.5.0b3.dev97.

Affected products

pyload pyload-ng <= 0.5.0b3.dev96

Identifiers

CVE-2026-33314
GHSA-q485-cg9q-xq2r
PYSEC-2026-122

Timeline

2026-03-19: advisory: GitHub Advisory published
2026-03-19: patched: Fix released in version 0.5.0b3.dev97

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.