pyload-ng localhost restriction bypass allowing arbitrary package creation

Severity: medium · CVSS 4 · Published 2025-07-08

pyload-ng is a download manager application that uses localhost-only access restrictions to protect sensitive administrative operations like package creation. An unauthenticated attacker can bypass these protections by manipulating HTTP Host headers, allowing them to create arbitrary download packages without authentication. This undermines the application's security model and could enable attackers to inject malicious downloads or disrupt the service.

Technologies: pyload-ng (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 4, published 8 July 2025.
Which products and versions are affected?
pyload-ng (PyPI) ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev77.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass (CWE-284: Improper Access Control) in the pyload-ng web application's localhost enforcement middleware. The application attempts to restrict access to the /flash/add endpoint (and similar administrative routes) by checking if the request originates from localhost or has a specific Host header value (127.0.0.1:9666 or [::1]:9666). However, the Host header check can be trivially spoofed by an attacker: sending a request with Host: 127.0.0.1:9666 from any network location bypasses the restriction because the middleware trusts the HTTP Host header without proper validation. Attack vector is network-based, requires no authentication or user interaction, and allows attackers to execute administrative functions (package creation) that should only be available to authenticated local administrators. No patched version is currently available according to the advisory.

Affected products

  • pyload pyload-ng < 0.5.0b3.dev77

Timeline

  • 2025-07-07: disclosed
  • 2025-07-08: advisory: GHSA-x698-5hjm-w2m5 published; GHSA-2wcm-vx67-3x4q withdrawn as duplicate on 2025-07-08

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.