CVE-2025-55156 PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
Attackers can inject SQL commands via the add_links API parameter to modify or delete database data in pyLoad.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55156?
CVE-2025-55156 is a high-severity SQL injection vulnerability in pyload, published on 11 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.
Weakness: CWE-89
Which versions are affected by CVE-2025-55156?
3 open source packages ship an affected version, including pyload-ng.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions | 0.5.0b3.dev91 |
pyload-ng PyPI | All versions | 0.5.0b3.dev91 |
pyload-ng PyPI | All versions | 0.5.0b3.dev91 |
How do I fix CVE-2025-55156?
Upgrade pyload-ng to 0.5.0b3.dev91 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-55156 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55156 exists.
Sources
Also known as GHSA-pwh4-6r3m-j2rf, PYSEC-2026-1821.