Executive brief
pyload-ng is a download manager application that uses localhost-only access restrictions to protect sensitive administrative operations like package creation. An unauthenticated attacker can bypass these protections by manipulating HTTP Host headers, allowing them to create arbitrary download packages without authentication. This undermines the application's security model and could enable attackers to inject malicious downloads or disrupt the service.
Technical details
The vulnerability is an authentication bypass (CWE-284: Improper Access Control) in the pyload-ng web application's localhost enforcement middleware. The application attempts to restrict access to the /flash/add endpoint (and similar administrative routes) by checking if the request originates from localhost or has a specific Host header value (127.0.0.1:9666 or [::1]:9666). However, the Host header check can be trivially spoofed by an attacker: sending a request with Host: 127.0.0.1:9666 from any network location bypasses the restriction because the middleware trusts the HTTP Host header without proper validation. Attack vector is network-based, requires no authentication or user interaction, and allows attackers to execute administrative functions (package creation) that should only be available to authenticated local administrators. No patched version is currently available according to the advisory.
Affected products
- pyload pyload-ng < 0.5.0b3.dev77
Timeline
- 2025-07-07: disclosed
- 2025-07-08: advisory: GHSA-x698-5hjm-w2m5 published; GHSA-2wcm-vx67-3x4q withdrawn as duplicate on 2025-07-08