CVE-2024-24808 pyLoad open redirect vulnerability due to improper validation of the is_safe_url function
An attacker can redirect users to malicious sites after login due to improper URL validation in pyLoad.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-24808?
CVE-2024-24808 is a medium-severity vulnerability in pyload, published on 6 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` function when redirecting users at login. This vulnerability has been patched with commit fe94451.
Weakness: CWE-601
Which versions are affected by CVE-2024-24808?
3 open source packages ship an affected version, including pyload-ng. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions | 0.5.0b3.dev79 |
pyload-ng PyPI | All versions | 0.5.0b3.dev79 |
pyload-ng PyPI | All versions | 0.5.0b3.dev79 |
Products include Pyload Pyload.
How do I fix CVE-2024-24808?
Upgrade pyload-ng to 0.5.0b3.dev79 or later.
Is CVE-2024-24808 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-24808 exists.
Other vulnerabilities in pyload
- CVE-2023-0297 Code Injection in pyload/pyload
- CVE-2026-33992 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
- CVE-2024-47821 pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API
- CVE-2024-32880 pyLoad allows upload to arbitrary folder lead to RCE
- CVE-2026-41133 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
Sources
Also known as GHSA-g3cm-qg2v-2hj5, PYSEC-2026-1817.