Executive brief
pyLoad is a download manager that allows users to queue and manage file downloads. A security flaw in its web interface allows an attacker to inject malicious scripts into the 'Downloads' view. If an administrator views the list of downloads, the attacker can steal their session cookies, potentially leading to full control over the pyLoad server and the underlying system.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in pyLoad's 'modern' theme. The 'packages.js' template literal interpolates several fields from the 'link' object (including url, name, and statusmsg) directly into HTML without escaping, subsequently rendering them via jQuery's .html() method. An authenticated attacker with 'Perms.ADD' privileges can submit a malicious URL containing a single quote and an event handler (e.g., onmouseover) to execute arbitrary JavaScript in the context of other users' browsers. Additionally, if the ClickNLoad handler is enabled, unauthenticated attackers can trigger this via the /flash/add endpoint. This can lead to session hijacking and remote code execution via administrative configuration changes.
Affected products
- pyLoad pyload-ng <= 0.5.0b3.dev99
Timeline
- 2026-05-14: advisory: GitHub Advisory published
- 2026-05-28: other: NVD published