Executive brief
pyload-ng is a download manager that automates file downloads from various websites. A vulnerability allows authenticated users with limited settings permissions to redirect all of the application's outgoing traffic through a server they control. This could lead to the theft of sensitive download credentials, session cookies, and the injection of malicious files into the download queue.
Technical details
The `set_config_value()` API method in `src/pyload/core/api/__init__.py` uses an allowlist (`ADMIN_ONLY_CORE_OPTIONS`) to restrict sensitive configuration changes to administrators. However, this list fails to include several proxy-related settings: `proxy.enabled`, `proxy.host`, `proxy.port`, and `proxy.type`. An authenticated user with the `Perms.SETTINGS` permission can modify these values to route all outbound HTTP traffic (downloads, updates, captcha requests) through an arbitrary proxy. This enables Man-in-the-Middle (MitM) attacks, allowing the interception of auth tokens and cookies, or the injection of malicious responses. This is an incomplete fix for a series of previous vulnerabilities in the same allowlist. A patch is available in version 0.5.0b3.dev100.
Affected products
- pyload pyload-ng <= 0.5.0b3.dev99
Timeline
- 2026-04-24: disclosed
- 2026-05-04: advisory: GitHub Advisory published
- 2026-05-11: other: NVD published