PT-2025-41449 · Pyload · Pyload

Odaysec · Published 2025-10-09 · Updated 2025-10-10 · CVE-2025-61773

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev91

Description pyLoad is a free and open-source download manager written in Python. Versions prior to 0.5.0b3.dev91 have insufficient input validation in the web interface, specifically in the Captcha script endpoint and the Click'N'Load (CNL) Blueprint. This allows untrusted user input to be processed unsafely, potentially leading to client-side code execution (XSS) or manipulation of request handling. User-supplied parameters from HTTP requests were not adequately validated or sanitized before being passed into the application logic and response generation. The CNL (Click'N'Load) blueprint exposed unsafe handling of untrusted parameters in HTTP requests.

Recommendations Update pyLoad to version 0.5.0b3.dev91 or later.

Exploit

Fix

Code Injection

Special Elements Injection

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-94

CWE-74

CWE-79

CWE-116

Related Identifiers

CVE-2025-61773

GHSA-CJJF-27CC-PVMV

Affected Products

Pyload

References · 12

• 🔥 https://github.com/pyload/pyload/security/advisories/GHSA-cjjf-27cc-pvmv · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61773.json · Exploit
• https://osv.dev/vulnerability/GHSA-cjjf-27cc-pvmv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61773 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61773 · Vendor Advisory
• https://github.com/pyload/pyload · Note
• https://github.com/pyload/pyload/pull/4624 · Note
• https://github.com/pyload/pyload/commit/5823327d0b797161c7195a1f660266d30a69f0ca · Note
• https://twitter.com/VulmonFeeds/status/1976502311703756809 · Twitter Post
• https://twitter.com/CveTodo/status/1976407342598992114 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o28ww8/resumen_diario_de_vulnerabilidades_09102025 · Reddit Post
• https://twitter.com/CVEnew/status/1976396264632877292 · Twitter Post