CVE-2024-1240 Open Redirection in pyload/pyload

What is CVE-2024-1240?

CVE-2024-1240 is a medium-severity vulnerability in pyload/pyload, published on 15 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other malicious activities. The issue is fixed in pyload-ng 0.5.0b3.dev79.

Weakness: CWE-601

Which versions are affected by CVE-2024-1240?

1 open source package ship an affected version, including pyload-ng. It affects 1 product.

Products include Pyload Pyload.

How do I fix CVE-2024-1240?

No fix has been published for CVE-2024-1240 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-1240 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1240 exists.

Other vulnerabilities in pyload/pyload

• CVE-2023-0297 Code Injection in pyload/pyload Critical 9.8
• CVE-2026-33992 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration Critical 9.3
• CVE-2024-47821 pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API Critical 9.1
• CVE-2024-32880 pyLoad allows upload to arbitrary folder lead to RCE Critical 9.1
• CVE-2026-41133 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3mmf-29wp-jc9p, PYSEC-2024-123.