CVE-2024-22416 - CVE House

Back to Database

Status published Critical CVE-2024-22416

Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

9.7 CVSS

Vulnerability Description

pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-22416

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from pyload

View All →

pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters

Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter

pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)

pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write

Affected Vendor

pyload

View all reports →

Affected Software

pyload

Vulnerable Versions:

< 0.5.0b3.dev78

Timeline

Official Publish: January 17th, 2024

Last Modified: June 17th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link

T1204.001 Malicious Link

T1098 Account Manipulation

T1565.001 Stored Data Manipulation