CVE-2024-21644: pyload-ng Unauthenticated Flask Configuration Leakage vulnerability
Summary
CVE-2024-21644: pyload Unauthenticated Flask Configuration Leakage vulnerability. Affects pyload-ng versions < 0.5.0b3.dev77. Fixed in 0.5.0b3.dev77. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyload-ng is an open-source download manager written in Python. It provides a web interface for managing downloads and supports various protocols. The vulnerability in pyload-ng allows unauthenticated users to access a specific URL and expose the Flask configuration, including the SECRET_KEY variable.
Vulnerability Detail
The vulnerability arises from a route in the application that can be accessed by any unauthenticated user. This route allows loading predefined templates, including the 'info.html' template. Normally, the Flask config passed to templates gets overwritten, but in this case, bypassing the function that overwrites it exposes the config. The config includes sensitive information such as the SECRET_KEY. Depending on how the Flask config data is used, this vulnerability can have detrimental consequences for security.
How To Fix
Latest published version: 0.5.0b3.dev101 as of 23 Oct 2026
pip install --upgrade "pyload-ng==0.5.0b3.dev101"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0b3.dev77
This is the first release that contains the fix.
pip install --upgrade "pyload-ng==0.5.0b3.dev77"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of pyload-ng.
Conclusion
The unauthenticated Flask configuration leakage vulnerability in pyload-ng can be fixed by upgrading to version 0.5.0b3.dev77 or later. It is important to address this vulnerability to prevent unauthorized access to sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyload-ng →
FAQ
pyload-ng is an open-source download manager written in Python.
The vulnerability allows unauthenticated users to access the Flask configuration, including the SECRET_KEY variable. Depending on how the Flask config data is used, this can have detrimental consequences for security.
To fix the vulnerability, upgrade to pyload-ng version 0.5.0b3.dev77 or later.
No, there is no known workaround. Upgrading to the fixed version is necessary.
You can find more information about pyload-ng on its official website or documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
