Executive brief
Cyberdrop-DL, a tool used for downloading files from various hosting services, contains a flaw that can leak user credentials. When a user attempts to download content from a specially crafted malicious link, the tool may inadvertently send the user's private Pixeldrain API key to the attacker's server. This could allow unauthorized individuals to access or manage the user's Pixeldrain account.
Technical details
A vulnerability exists in cyberdrop-dl-patched where the Pixeldrain crawler uses substring matching to identify supported hosts. Because the tool dynamically uses the host from the input URL for API requests to support Pixeldrain's alternative domains, a malicious domain containing the string 'pixeldrain' (e.g., evil-pixeldrain.com) will trigger the crawler. The application then sends the user's 'Authorization' header containing their API key to the attacker-controlled host. This is fixed in version 9.14.0 by implementing exact host matching for official domains.
Affected products
- Cyberdrop-DL cyberdrop-dl-patched >= 8.5.0, < 9.14.0
Timeline
- 2026-06-04: disclosed: Initial report to maintainers
- 2026-07-15: advisory: GitHub Advisory published
- 2026-07-15: patched: Version 9.14.0 released