CVE-2026-33511CWE-639

pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad

High · published March 24, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
50.4
In the wild
Unconfirmed
What it is

pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows unauthenticated remote users to access localhost-restricted endpoints, enabling them to inject arbitrary downloads, write files to the storage directory, and execute JavaScript code. This issue has been patched in version 0.5.0b3.dev97.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:L/SA:N
EPSS
0.00648 · 50.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-24T18:56Z
EPSS history
Timeline
  • 24 MAR 18:56Z
    pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad
    cvelistv5