CVE Feed

    Dashboard / CVE / CVE-2024-22416

    CVE-2024-22416

    pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

    Published:Jan 17, 2024
    Last Modified:Jun 17, 2025
    EPS:Jan 17, 2024
    EPSS Score:0.05898
    CVSS Score:9.7

    Affected Products

    Vendor
    Pyload-ng Project
    Product
    Pyload-ng

    Exploits

    https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fmhttps://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fmhttps://github.com/mindstorm38/ensimag-secu3a-cve-2024-22416https://github.com/theorzr/ensimag-secu3a-cve-2024-22416

    Related CVEs

    CVE-2026-42315 (CVSS 8.1) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a f…
    CVE-2026-42314 (CVSS 6.5) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder n…
    CVE-2026-42312 (CVSS 6.8) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_v…
    CVE-2026-42313 (CVSS 8.3) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_v…
    CVE-2026-40594 (CVSS 4.8) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_c…
    CVE-2026-35592 (CVSS 5.3) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extract…
    CVE-2026-35586 (CVSS 6.8) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CO…
    CVE-2026-35463 (CVSS 8.8) — pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_O…
    CVE-2026-35459 (CVSS 9.3) — pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has …
    CVE-2026-35187 (CVSS 7.7) — pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_u…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High