pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters

An attacker can exploit this XSS vulnerability by crafting malicious payloads and submitting them through the Captcha script endpoint or the Click'N'Load Blueprint. The lack of proper input validation allows these payloads to be processed unsafely, injecting arbitrary content into the web UI. This injected content can then execute client-side scripts, potentially stealing user cookies, redirecting users to phishing sites, or defacing the pyLoad-ng web interface. The impact extends beyond simple defacement; an attacker could leverage this vulnerability to gain persistent access to the system if they can execute malicious code within the context of a legitimate user's session. The potential for lateral movement depends on the privileges of the user account accessing the vulnerable pyLoad-ng instance, but the blast radius could be significant if the system is part of a larger network.

Organizations utilizing pyLoad-ng for download management and those with publicly accessible instances are at risk. Specifically, deployments using older versions (≤0.5.0b3.dev90) and those with limited input validation practices are particularly vulnerable. Shared hosting environments where multiple users share the same pyLoad-ng instance are also at increased risk.

• python: Monitor pyLoad-ng logs for unusual HTTP requests containing suspicious characters or patterns commonly associated with XSS attacks (e.g., <script>, <iframe>, javascript:). • generic web: Use curl or wget to test the Captcha script endpoint and Click'N'Load Blueprint with various payloads containing XSS patterns. Examine the response for signs of code execution.

curl -X POST -d '<script>alert("XSS")</script>' https://your-pyload-ng-instance/captcha

• generic web: Inspect access and error logs for requests containing XSS payloads or resulting in errors related to script execution. • generic web: Check response headers for unexpected content or modifications that could indicate XSS activity.

1. 2025-10-09Disclosure

   disclosure

1. 已保留2025-09-30
2. 发布日期2025-10-09
3. 修改日期2025-10-13
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-61773 is to upgrade pyLoad-ng to version 0.5.0b3.dev91 or later, which contains the necessary input validation fixes. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider implementing temporary workarounds. These may include restricting access to the Captcha script endpoint and Click'N'Load Blueprint to trusted users only. Web application firewalls (WAFs) can be configured to filter out potentially malicious input based on known XSS patterns. Regularly review and sanitize user input within the pyLoad-ng web interface to prevent future vulnerabilities. After upgrading, confirm the fix by attempting to submit a known malicious payload through the Captcha script endpoint and verifying that it is properly sanitized and does not execute.