CVE-2026-33314

The SSRF vulnerability in pyLoad-ng arises from a Host Header Spoofing issue within the @local_check decorator. An attacker can exploit this by crafting malicious requests that bypass the intended local-only restrictions. Successful exploitation grants access to the Click'N'Load API endpoints, effectively allowing the attacker to remotely queue arbitrary downloads. This can lead to a denial-of-service condition by overwhelming the server with requests or potentially enabling attackers to download sensitive files accessible to the server. The impact is amplified by the unauthenticated nature of the vulnerability, meaning no prior authentication is required to exploit it.

Organizations and individuals utilizing pyLoad-ng for download management, particularly those running instances accessible from external networks, are at risk. Shared hosting environments where pyLoad-ng is installed alongside other applications are also vulnerable, as a successful exploit could potentially compromise other services on the same server.

• python / server:

import requests
import re

def check_pyload_version(url):
    try:
        response = requests.get(f'{url}/api/version')
        response.raise_for_status()
        version = response.json().get('version', 'unknown')
        if re.match(r'^0\.5\.0b3\.dev[0-9]+$', version):
            return True
        return False
    except requests.exceptions.RequestException:
        return False

# Example usage
url = 'http://your-pyload-instance' # Replace with your pyload instance URL
if check_pyload_version(url):
    print('Vulnerable version detected!')
else:
    print('Version is likely patched.')

• generic web:

curl -I http://your-pyload-instance/api/ | grep Host

1. 2026-03-19Disclosure

   disclosure

2. 2026-03-19Patch

   patch

1. Reservado2026-03-18
2. Publicada2026-03-19
3. Modificada2026-03-27
4. EPSS atualizado2026-04-01

The primary mitigation for CVE-2026-33314 is to immediately upgrade pyLoad-ng to version 0.5.0b3.dev97 or later, which contains the fix for the Host Header Spoofing vulnerability. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) or reverse proxy to filter requests and block those with suspicious Host headers. Specifically, configure the WAF to reject requests with Host headers that do not match the expected domain. Regularly review and update pyLoad-ng's configuration to ensure adherence to security best practices.