CVE-2025-7346: Pyload ng PyLoad Is Vulnerable To Attacks Vulnerability
HIGH
Advisory Identifier:
GHSA-x698-5hjm-w2m5
Advisory Summary
CVE-2025-7346 is a HIGH (CVSS 7.5) pyload is vulnerable to attacks vulnerability (CWE-284: Improper Access Control) affecting Pyload ng libraries in the PyPI ecosystem. The issue involves pyload is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages. Remediation is available in the latest vendor maintenance releases.
CVE-2025-7346 at a Glance
CVE Identifier
CVE-2025-7346
GHSA Identifier
GHSA-x698-5hjm-w2m5
Severity
HIGH
CVSS v3.1 Base Score
7.5
CWE Classification
CWE-284: Improper Access Control
Affected Product
Pyload ng
Package Ecosystem
PyPI
Published Date
Last Updated
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
None (PR:N)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
None (C:N)
Integrity
High (I:H)
Availability
None (A:N)
How to Fix CVE-2025-7346
To remediate this vulnerability, upgrade all affected Pyload ng dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pyload-ng
fixed: Latest secure release
pip install pyload-ng>=Latest secure release
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show pyload-ngHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2025-7346, inspect your installed packages using pip:
pip show pyload-ngAnalyze the terminal output to locate any version of Pyload ng in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The pip show pyload-ng command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-284: Improper Access Control, where the product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. In Pyload ng, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages.
### Details
Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages. This is done by changing the `Host` header to the value of `127.0.0.1:9666`.
### PoC
The application has middleware that prevents access to several routes by checking whether the `Host` header has a specific value. We bypassed this restriction.
https://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L21-L36
```python
#: decorator
def local_check(func):
@wraps(func)
def wrapper(*args, **kwargs):
remote_addr = flask.request.environ.get("REMOTE_ADDR", "0")
http_host = flask.request.environ.get("HTTP_HOST", "0")
if remote_addr in ("127.0.0.1", "::ffff:127.0.0.1", "::1", "localhost") or http_host in (
"127.0.0.1:9666",
"[::1]:9666",
):
return func(*args, **kwargs)
else:
return "Forbidden", 403
return wrapper
```
Below we see that the '/flash/add' endpoint uses the middleware above.
https://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L56-L58C11
```python
@bp.route("/flash/add", methods=["POST"], endpoint="add")
@local_check
def add():
```
Notice how we are not authorized to access this endpoint when sending a request.
However, if we set the `Host` header to be `127.0.0.1:9666`, we notice the request returns `success`.
Checking the front end as an admin, we now see that this did indeed succeed.
### Impact
An unauthenticated user can perform actions that should only be available to authenticated users.
CVE-2025-7346 Affected Pyload ng Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
pyload-ng
|
PyPI |
≤ 0.5.0b3.dev88
|
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/pyload/pyload/security/advisories/GHSA-x698-5hjm-w2m5
Security Fix Commit
FIX COMMIT
https://github.com/pyload/pyload/commit/f4e2d12416ba2dfac7b036d5c8d6dab5461b9840
Pyload ng Source Repository
REPOSITORY
https://github.com/pyload/pyload
Pyload ng Source Repository
REPOSITORY
https://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L21-L36
Pyload ng Source Repository
REPOSITORY
https://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L56-L58C11
Frequently Asked Questions
What is CVE-2025-7346?
CVE-2025-7346 is a security vulnerability in Pyload ng involving pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages under CWE-284: Improper Access Control.
Which Pyload ng versions are affected?
Affected versions include releases prior to current release patches across affected packages: pyload-ng.
What version fixes CVE-2025-7346?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is pyload-ng affected?
Yes, pyload-ng is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What is the CVSS score of CVE-2025-7346?
CVE-2025-7346 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
What CWE is associated with CVE-2025-7346?
CVE-2025-7346 is classified under CWE-284: Improper Access Control (The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.).
How can I check PyPI dependencies for CVE-2025-7346?
Run the dependency tree command: 'pip show pyload-ng'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-x698-5hjm-w2m5",
"modified" : "2025-07-08T23:38:45Z",
"published" : "2025-07-08T21:36:52Z",
"aliases" : [ "CVE-2025-7346" ],
"summary" : "pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages",
"details" : "### Summary\nAny unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages.\n\n### Details\nAny unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages. This is done by changing the `Host` header to the value of `127.0.0.1:9666`.\n\n### PoC\nThe application has middleware that prevents access to several routes by checking whether the `Host` header has a specific value. We bypassed this restriction.\n\nhttps://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L21-L36\n```python\n#: decorator\ndef local_check(func):\n @wraps(func)\n def wrapper(*args, **kwargs):\n remote_addr = flask.request.environ.get(\"REMOTE_ADDR\", \"0\")\n http_host = flask.request.environ.get(\"HTTP_HOST\", \"0\")\n\n if remote_addr in (\"127.0.0.1\", \"::ffff:127.0.0.1\", \"::1\", \"localhost\") or http_host in (\n \"127.0.0.1:9666\",\n \"[::1]:9666\",\n ):\n return func(*args, **kwargs)\n else:\n return \"Forbidden\", 403\n\n return wrapper\n```\n\nBelow we see that the '/flash/add' endpoint uses the middleware above.\n\nhttps://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L56-L58C11\n```python\n@bp.route(\"/flash/add\", methods=[\"POST\"], endpoint=\"add\")\n@local_check\ndef add():\n```\n\nNotice how we are not authorized to access this endpoint when sending a request.\n\n\nHowever, if we set the `Host` header to be `127.0.0.1:9666`, we notice the request returns `success`.\n\n\nChecking the front end as an admin, we now see that this did indeed succeed.\n\n\n### Impact\nAn unauthenticated user can perform actions that should only be available to authenticated users.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "pyload-ng"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "0.5.0b3.dev88"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/pyload/pyload/security/advisories/GHSA-x698-5hjm-w2m5"
}, {
"type" : "WEB",
"url" : "https://github.com/pyload/pyload/commit/f4e2d12416ba2dfac7b036d5c8d6dab5461b9840"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/pyload/pyload"
}, {
"type" : "WEB",
"url" : "https://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L21-L36"
}, {
"type" : "WEB",
"url" : "https://github.com/pyload/pyload/blob/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d/src/pyload/webui/app/blueprints/cnl_blueprint.py#L56-L58C11"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-284", "CWE-290" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-07-08T21:36:52Z",
"nvd_published_at" : null
}
}