CVE-2026-42313

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The allowlist contains ("proxy", "username") and ("proxy", "password") — which protect the proxy credentials — but it does not include ("proxy", "enabled"), ("proxy", "host"), ("proxy", "port"), or ("proxy", "type"). Any authenticated user with the non-admin SETTINGS permission can enable proxying and point pyload at any host they control. From that point, every outbound download, captcha fetch, update check, and plugin HTTP call is transparently routed through the attacker. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.

• CWE-441
• CWE-863
• CWE-918

• https://github.com/pyload/pyload/security/advisories/GHSA-pg67-9wjv-mr85Exploit, Vendor Advisory
• https://github.com/pyload/pyload/security/advisories/GHSA-pg67-9wjv-mr85Exploit, Vendor Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42308Pillow is a Python imaging library. Prior to version 12.2.0,…5.5
• CVE-2026-42309Pillow is a Python imaging library. From version 11.2.1 to b…5.5
• CVE-2026-4231A vulnerability was found in vanna-ai vanna up to 2.0.2. Aff…7.3
• CVE-2026-42310Pillow is a Python imaging library. From version 4.2.0 to be…5.5
• CVE-2026-42311Pillow is a Python imaging library. From version 10.3.0 to b…7.8
• CVE-2026-42312pyLoad is a free and open-source download manager written in…6.8
• CVE-2026-42314pyLoad is a free and open-source download manager written in…6.5
• CVE-2026-42315pyLoad is a free and open-source download manager written in…6.5
• CVE-2026-42316kafka-sink-azure-kusto Kafka Connect plugin is the official …6.5
• CVE-2026-42317GLPI is a free asset and IT management software package. Sta…7
• CVE-2026-42318GLPI is a free asset and IT management software package. Sta…7
• CVE-2026-4232A vulnerability was determined in Tiandy Integrated Manageme…7.3