pyLoad up to 0.5.0b3.dev100 HTTP Call __init__.py set_config_value confused deputy

Summaryinfo

A vulnerability marked as critical has been reported in pyLoad up to 0.5.0b3.dev100. Affected by this vulnerability is the function set_config_value of the file src/pyload/core/api/__init__.py of the component HTTP Call Handler. The manipulation leads to confused deputy. This vulnerability is documented as CVE-2026-42313. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in pyLoad up to 0.5.0b3.dev100. It has been rated as critical. This issue affects the function set_config_value of the file src/pyload/core/api/__init__.py of the component HTTP Call Handler. The manipulation with an unknown input leads to a confused deputy vulnerability. Using CWE to declare the problem leads to CWE-441. The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The allowlist contains ("proxy", "username") and ("proxy", "password") — which protect the proxy credentials — but it does not include ("proxy", "enabled"), ("proxy", "host"), ("proxy", "port"), or ("proxy", "type"). Any authenticated user with the non-admin SETTINGS permission can enable proxying and point pyload at any host they control. From that point, every outbound download, captcha fetch, update check, and plugin HTTP call is transparently routed through the attacker. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-42313 since 04/26/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 0.5.0b3.dev100 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• pyLoad

Version

• 0.5.0b3

Website

• Product: https://github.com/pyload/pyload/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion