pyload-ng@0.5.0b3.dev60 vulnerabilities

pyload-ng is a The free and open-source Download Manager written in pure Python

Affected versions of this package are vulnerable to Unrestricted Upload of File with Dangerous Type due to the ability to change the download folder and upload a crafted template. An attacker can execute arbitrary code on the server by uploading a malicious template file to a specified folder and then navigating to a URL that renders the uploaded template.

Upgrade pyload-ng to version 0.5.0b3.dev85 or higher.

pyload-ng is a The free and open-source Download Manager written in pure Python

Affected versions of this package are vulnerable to Open Redirect via the is_safe_url function. An attacker can redirect users to malicious websites, which may be used for phishing and similar attacks by manipulating the URL input in the next variable to bypass URL validation.

Upgrade pyload-ng to version 0.5.0b3.dev79 or higher.

pyload-ng is a The free and open-source Download Manager written in pure Python

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to the API accepting GET requests without proper validation. An attacker can perform unauthorized actions on behalf of a legitimate user due to the session cookie not being set to SameSite: strict.

Upgrade pyload-ng to version 0.5.0b3.dev78 or higher.

pyload-ng is a The free and open-source Download Manager written in pure Python

Affected versions of this package are vulnerable to Improper Output Neutralization for Logs. An attacker can inject arbitrary messages into the logs via the username, which could be used to obscure their activities or falsely implicate another individual in malicious actions.

Upgrade pyload-ng to version 0.5.0b3.dev77 or higher.

pyload-ng is a The free and open-source Download Manager written in pure Python

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Externally-Accessible File or Directory due to improper handling of a specific URL which exposes the Flask config, including the SECRET_KEY variable. An attacker can gain access to sensitive information by navigating to the exposed URL without authentication.

Upgrade pyload-ng to version 0.5.0b3.dev77 or higher.

pyload-ng is a The free and open-source Download Manager written in pure Python

Affected versions of this package are vulnerable to Directory Traversal when the add_package and edit_package functions are used. An attacker can store files anywhere on the server and gain command execution by abusing scripts. This is only exploitable if a user creates a new package and then edits it to pick any arbitrary directory in the filesystem.

Upgrade pyload-ng to version 0.5.0b3.dev75 or higher.