CVE-2025-7346: pyload-ng Vulnerability Allows Unauthenticated Package Creation
Summary
CVE-2025-7346: Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages. Affects pyload-ng versions < 0.5.0b3.dev88. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyload-ng is an open-source download manager that enables users to manage and automate the downloading of files from various sources. It is designed to be lightweight and user-friendly, providing features such as support for multiple file hosters, a web interface, and plugin capabilities. However, a critical vulnerability has been identified that allows unauthenticated users to bypass localhost restrictions, potentially leading to unauthorized actions within the application.
Vulnerability Detail
The vulnerability arises from inadequate validation of the 'Host' header in the application. An unauthenticated attacker can manipulate the 'Host' header to mimic requests from localhost, thereby bypassing security checks intended to restrict access to certain functionalities. This flaw allows attackers to create arbitrary packages, which could lead to unauthorized access and manipulation of the application. The vulnerability is classified under CWE-284 (Improper Access Control) and CWE-290 (Authentication Bypass by Spoofing).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional checks on the server-side to validate the 'Host' header against a whitelist of allowed values. For example, you can modify the middleware function as follows:
#: decorator
def local_check(func):
@wraps(func)
def wrapper(*args, **kwargs):
remote_addr = flask.request.environ.get("REMOTE_ADDR", "0")
http_host = flask.request.environ.get("HTTP_HOST", "0")
if remote_addr in ("127.0.0.1", "::ffff:127.0.0.1", "::1", "localhost") or http_host in (
"127.0.0.1:9666",
"[::1]:9666",
):
return func(*args, **kwargs)
else:
return "Forbidden", 403
return wrapper
Conclusion
The pyload-ng package has a critical vulnerability (CVE-2025-7346) that allows unauthenticated users to bypass security measures and create arbitrary packages. It is essential to update to the latest version to mitigate this risk. Users can also implement temporary workarounds until they can apply the necessary updates.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2025-7346 is a vulnerability in the pyload-ng package that allows unauthenticated users to bypass localhost restrictions and create arbitrary packages.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If you cannot update the package immediately, consider implementing the provided workaround to restrict access based on the 'Host' header.
More information about pyload-ng can be found on its official GitHub repository and documentation pages.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
