CVE-2026-33511: pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad
pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the localcheck decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows unauthenticated remote users to access localhost-restricted endpoints, enabling them to inject arbitrary downloads, write files to the storage directory, and execute JavaScript code. This issue has been patched in version 0.5.0b3.dev97.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33511?
CVE-2026-33511 is classified as a critical vulnerability due to its potential for unauthorized access.
How do I fix CVE-2026-33511?
To fix CVE-2026-33511, upgrade pyload-ng to version 0.5.0b3.dev97 or later.
What systems are affected by CVE-2026-33511?
CVE-2026-33511 affects pyload-ng versions from 0.4.20 to before 0.5.0b3.dev97.
Can CVE-2026-33511 be exploited remotely?
Yes, CVE-2026-33511 can be exploited remotely through host header injection.
What feature of pyload is vulnerable in CVE-2026-33511?
The local_check decorator in pyLoad's ClickNLoad feature is vulnerable in CVE-2026-33511.