CVE-2025-55156: PyLoad SQL Injection Vulnerability in add_links Parameter
Summary
CVE-2025-55156: PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter. Affects pyload-ng versions < 0.5.0b3.dev91. Fixed in 0.5.0b3.dev91. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyLoad is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It provides features such as link management, password protection, and integration with various file hosting services. However, a vulnerability has been identified in its API, specifically in the add_links parameter, which can lead to SQL injection attacks.
Vulnerability Detail
The vulnerability arises from the improper handling of user input in the add_links parameter of the API endpoint /json/add_package. The parameter is directly incorporated into an SQL query without proper sanitization, allowing attackers to manipulate the SQL command. This can lead to unauthorized data access, modification, or deletion, potentially compromising sensitive information stored in the database.
How To Fix
Latest published version: 0.5.0b3.dev101 as of 23 Oct 2026
pip install --upgrade "pyload-ng==0.5.0b3.dev101"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0b3.dev91
This is the first release that contains the fix.
pip install --upgrade "pyload-ng==0.5.0b3.dev91"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, a temporary workaround involves modifying the update_link_info method to use parameterized queries instead of directly inserting user input into the SQL statement. Here is an example of how to implement this:
def update_link_info(self, data):
"""
data is list of tuples (name, size, status, url)
"""
self.c.executemany(
"UPDATE links SET name=?, size=?, status=? WHERE url=? AND status IN (1,2,3,14)",
data,
)
# Collect all URLs
urls = [x[3] for x in data]
# Create parameterized query to prevent SQL injection
placeholders = ','.join(['?'] * len(urls))
query = f"SELECT id FROM links WHERE url IN ({placeholders}) AND status IN (1,2,3,14)"
self.c.execute(query, urls)
ids = [int(row[0]) for row in self.c.fetchall()]
return ids
Conclusion
The CVE-2025-55156 vulnerability in PyLoad highlights the importance of secure coding practices, particularly in handling user inputs. By updating to the latest version and implementing parameterized queries, developers can mitigate the risks associated with SQL injection attacks.
See every vulnerability recorded for pyload-ng →
FAQ
SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It can allow attackers to view data that they are not normally able to retrieve.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The potential impacts include unauthorized access to sensitive data, data modification, and even data deletion, which can lead to significant data loss and integrity issues.
To protect your application, always use parameterized queries or prepared statements when interacting with the database, and validate and sanitize user inputs.
Yes, the vulnerability has been patched in version 0.5.0b3.dev91 of the PyLoad package. It is recommended to update to this version or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
