Pyload EUVD-2026-15001

Remote unauthenticated attacker exploiting pyLoad versions 0.4.20 through 0.5.0b3.dev96 by spoofing HTTP Host header to bypass local_check decorator protecting ClickNLoad feature localhost-restricted endpoints. No victim interaction required.

This vulnerability presents a high real-world risk despite the absence of a published CVSS vector. The attack vector is CVSS:AV:N (network-based, unauthenticated remote exploitation), attack complexity is low (trivial HTTP header spoofing requires no special knowledge or tools), and the impact is severe: arbitrary file writes, arbitrary download injection, and JavaScript execution. No privilege escalation is required—the attacker gains the full capabilities of the pyLoad process immediately. The vulnerability affects all pyLoad instances exposed to network access without additional access controls. While no explicit KEV (Known Exploited Vulnerability) status or public proof-of-concept is referenced in the provided intelligence, the straightforward nature of the bypass (HTTP header manipulation) means exploitation is highly automatable and likely actively weaponized post-disclosure. The patch availability (version 0.5.0b3.dev97 and later) and the fact that this is an open-source project with a public security advisory suggest this should be treated as an active threat. The real-world risk is amplified by the fact that pyLoad is frequently deployed in home network and small business environments where it may be directly exposed to untrusted networks.

An attacker on the internet crafts an HTTP request to a publicly accessible pyLoad instance with the Host header set to localhost or 127.0.0.1, bypassing the local_check decorator. The attacker then calls the protected ClickNLoad endpoint to inject a malicious download URL, causing pyLoad to download and execute arbitrary content, or directly invokes file-write endpoints to plant malware in the storage directory. Because the vulnerability requires only HTTP header manipulation (AV:N/AC:L), the attack can be automated and launched at scale against internet-facing pyLoad instances without any authentication credentials or user interaction.