CVE-2024-24808

pyLoad open redirect vulnerability due to improper validation of the is_safe_url function

pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` function when redirecting users at login. This vulnerability has been patched with commit fe94451.

Affected

pyload

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1 GITHUB

4.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

EPSS

0.55% chance of exploitation in the next 30 days, 45th percentile

Published

2024-02-06

Updated

2025-05-09

Proof-of-concept exploits (1)

• pyload/pyload/security/advisories/GHSA-g3cm-qg2v-2hj5

Security advisories

• advisories/GHSA-g3cm-qg2v-2hj5
• pyload/pyload/commit/fe94451dcc2be90b3889e2fd9d07b483c8a6dccd

References

• CVE Record
• NVD entry