pyload-ng

The free and open-source Download Manager written in pure Python

More links

Download Stats Bug Tracker Documentation Source Code (mirror)

Known Vulnerability

The current version has a known security vulnerability. Review the advisory and consider upgrading.

Security Vulnerability PYSEC-2026-4292

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

Source: osv.dev · Flagged: Yesterday

Security Vulnerability PYSEC-2026-4293

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Source: osv.dev · Flagged: Yesterday

Security Vulnerability High GHSA-68w4-83fh-f2w8

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

Source: osv.dev · Flagged: 1 week ago

Security Vulnerability High GHSA-fr26-jjhm-638c

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

Source: osv.dev · Flagged: 1 week ago

Security Vulnerability High GHSA-jq7h-wrvp-3rgx

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

Source: osv.dev · Flagged: 1 week ago

Security Vulnerability High GHSA-r44w-v6gf-x3p6

pyLoad has an authentication bypass in API key validation (check_apikey cache)

Source: osv.dev · Flagged: 1 week ago

Security Vulnerability High GHSA-889w-m37p-88m5

pyLoad: Api.set_user_permission never invalidates the target's session

Source: osv.dev · Flagged: 1 week ago

Security Vulnerability PYSEC-2026-493

pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-498

Code Injection in pyload-ng

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-492

pyLoad allows upload to arbitrary folder lead to RCE

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-906

Pyload Insufficient Session Expiration vulnerability

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-904

pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-903

Improper Certificate Validation in pyload-ng

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-496

pyLoad vulnerable to XSS through insecure CAPTCHA

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-497

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-494

Excessive Attack Surface in pyload-ng

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-495

pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-905

Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-907

Cross-site Scripting in pyload-ng

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-908

Improper Input Validation in pyload-ng

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-499

pyload-ng vulnerable to RCE with js2py sandbox escape

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2994

pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2993

PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2988

pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2992

pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2991

pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2990

pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2996

pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2995

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2998

pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2989

pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2997

pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-2267

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-124

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-1823

`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-121

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-1822

pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-1817

pyLoad open redirect vulnerability due to improper validation of the is_safe_url function

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-1820

pyload Unauthenticated Flask Configuration Leakage vulnerability

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-122

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-123

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-129

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-127

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-126

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-1816

pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-128

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-1821

PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-1815

Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-125

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-1818

pyload Log Injection vulnerability

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2026-1819

Download to arbitrary folder can lead to RCE

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2024-123

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2024-302

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability PYSEC-2024-17

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-w7hq-f2pj-c53g

pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-x698-5hjm-w2m5

pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-xqpg-92fq-grfg

`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-w48f-wwwf-f5fr

pyLoad: Improper Neutralization of Special Elements used in an OS Command

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-mqpq-2p68-46fv

pyload Unauthenticated Flask Configuration Leakage vulnerability

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-pwh4-6r3m-j2rf

PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability Critical GHSA-m74m-f7cr-432x

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-pg67-9wjv-mr85

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability Critical GHSA-r9pp-r4xf-597r

pyload-ng vulnerable to RCE with js2py sandbox escape

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-r7mc-x6x7-cqxx

pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability Critical GHSA-pgpj-v85q-h5fm

Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability Critical GHSA-pf38-5p22-x6h6

Code Injection in pyload-ng

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-cjjf-27cc-pvmv

pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-h73m-pcfw-25h2

Download to arbitrary folder can lead to RCE

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-fcjq-435v-jx94

pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-838g-gr43-qqg9

PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability Critical GHSA-8w3f-4r8f-pf53

pyLoad vulnerable to XSS through insecure CAPTCHA

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability Critical GHSA-7gvf-3w72-p2pg

pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-8v53-23mx-hcf9

Improper Certificate Validation in pyload-ng

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability Critical GHSA-6jmx-pv77-wm5w

Excessive Attack Surface in pyload-ng

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-6px9-j4qr-xfjw

pyLoad has an Arbitrary File Write via Path Traversal in edit_package()

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-9gjj-6gj7-c4wj

Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-2wvg-62qm-gj33

pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability Critical GHSA-3f7w-p8vr-4v5f

pyLoad allows upload to arbitrary folder lead to RCE

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-4744-96p5-mp2j

pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability High GHSA-66hx-chf7-3332

pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

Source: osv.dev · Flagged: 2 weeks ago

Security Vulnerability Critical GHSA-48rp-jc79-2264

pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)

Source: osv.dev · Flagged: 2 weeks ago

Monthly downloads

6.4K

Weekly downloads

2.4K

GitHub stars

3.9K

Downloads in the 30 and 7 days to October 10, 2026. Refreshed weekly.

Package Information

Latest Version

Requires Python

>=3.9

Licence

agpl3

Last Release

-

Author

pyLoad team

First Release

June 11, 2019

Total Releases

106

Python Versions

3.9 3.10 3.11 3.12 3.13

Current security advisory — review the warning above

Package Insights

Package Risks

No releases in 282 days despite active commits

click for breakdown

Actively Maintained

click for breakdown

Community Favorite

click for breakdown

click for breakdown

Score breakdown - each component scores 0-100, weighted by percentage

Maintenance

100

Popularity

79

Adoption

78

Community

80

Provenance

0

How the maintenance status was determined

Last commit

5 days ago

Monthly downloads

6,361

• Active

Activity within 30 days

Stable

Activity within 31-180 days

Minimal

Activity within 181-365 days, or no activity data

At Risk

No activity for > 365 days, but > 10,000 monthly downloads

Archived

Repository flagged as archived on GitHub

How the popularity category was determined

Monthly downloads

6,361

Stars

3,881

Stars per 1k downloads

610.12

Industry Standard

> 10,000,000 monthly downloads

Hidden Gem

< 0.5 stars per 1k downloads and > 100,000 monthly downloads

• Community Favorite

> 5 stars per 1k downloads

Rising Star

Balanced ratio of stars to downloads

Unknown

Fewer than 1,000 monthly downloads, or no star data

How download momentum is calculated

Week daily avg

344

Month daily avg

212

Momentum

+62.1%

((week_daily_avg - month_daily_avg) / month_daily_avg) * 100

More insights and metrics

click for breakdown

click for breakdown

Release Cadence

click for breakdown

Contributor Risk

click for breakdown

Python version support tiers

requires_python

>=3.9

Cutting Edge

Minimum supported version is 3.14 or newer

Modern

Minimum supported version is 3.11 to 3.13

• Legacy

Supports 3.10 or older (or Python 2)

Unknown

No requires_python specified or unparseable

License categories

License

agpl3

Permissive

MIT, Apache, BSD, ISC, Unlicense, CC0, etc.

• Copyleft

GPL, LGPL, AGPL, MPL, EPL, etc.

Proprietary

Commercial, all rights reserved, custom EULAs

Unknown

No license specified, or none of the above match

How the release cadence was determined

Last release

288 days ago

Total releases

106

Releases/year

14.4

• Rapid

Last release within 365 days and > 12 releases/year

Regular

Last release within 365 days

Slow

Last release 366-730 days ago

Stalled

Last release > 730 days ago, or no releases

Unknown

No usable release date available

How contributor risk was determined

Contributors

189

Monthly downloads

6,361

High Load

≤ 2 contributors and ≥ 50,000 monthly downloads

Moderate Load

< 10 contributors and ≥ 500,000 monthly downloads

Low Load

< 25 contributors and ≥ 5,000,000 monthly downloads, or sole maintainer with ≥ 10,000 monthly downloads

• Balanced

Enough contributors for the package's popularity

Unknown

No contributor data available

Engagement

91

Issue Burden

47.7

per 1k stars

Discussions

14.2

per 1k stars

Fork Ratio

25.1%

contrib / forks

Stale Release

282d

PR Velocity

Quiet

Not all downloads include detailed metadata. Breakdowns reflect the subset that does.

Downloads by OS

Linux 49

Windows 4

macOS 1

Python Versions

3.13

35.2% 19

3.12

27.8% 15

3.10

16.7% 9

3.14

16.7% 9

3.11

3.7% 2

Top Countries

1.

SG

105

2.

DE

29

3.

US

18

4.

CN

5

5.

FR

5

6.

IN

4

7.

AT

2

8.

GB

2

9.

IT

2

10.

JP

2

Weekly Downloads

Last 7 days

2,406

Last 30 days

6,361

Peak week (to 2026-10-10)

2,406

2026-09-25 – 2026-10-10. Enable JavaScript for the interactive chart.

GitHub Stars

Current

3,881

Earliest (2026-09-26)

3,877

Change

+4

2026-09-26 – 2026-10-11. Enable JavaScript for the interactive chart.

Dependencies

20

20 optional dependencies

babel[build]
extra == "build"
babel[all]
extra == "all"
beautifulsoup4[all]
extra == "all"
beautifulsoup4[plugins]
extra == "plugins"
colorlog[plugins]
extra == "plugins"
colorlog[all]
extra == "all"
jinja2[all]
extra == "all"
jinja2[build]
extra == "build"
openapi-spec-validator[test]
extra == "test"
pillow[all]
extra == "all"
pillow[plugins]
extra == "plugins"
pyopenssl[plugins]
extra == "plugins"
pyopenssl[all]
extra == "all"
pytest[test]
extra == "test"
pytest-cov[test]
extra == "test"
send2trash[all]
extra == "all"
send2trash[plugins]
extra == "plugins"
slixmpp[all]
extra == "all"
slixmpp[plugins]
extra == "plugins"
tox[test]
extra == "test"

Used By

1

ez-pyload 154/mo

Repository details

Forks

752

Issues

185

Last Commit

6 days ago

Contributors

189

Open PRs

30

Archived

No

GitHub Topics

Python Downloadmanager Downloader Download Jdownloader Pyload Headless Qnap Cyberlocker Debrid Linkdecrypter Raspberry Pi Ddl Webui Flashgot Synology Pypi

Data and sources

Tracking Since

September 26, 2026

Data Updated

October 11, 2026

Data Freshness

Fresh

Keywords

pyload download-manager one-click-hoster download

Sources and methodology