CVE-2025-7346 pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages
Unauthenticated attackers can bypass localhost restrictions to create arbitrary packages, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-7346?
CVE-2025-7346 is a high-severity authentication bypass vulnerability in Pyload, published on 8 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages
Weakness: CWE-281
Which versions are affected by CVE-2025-7346?
3 open source packages ship an affected version, including pyload-ng.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions to 0.5.0b3.dev88 | None |
pyload-ng PyPI | All versions to 0.5.0b3.dev88 | None |
pyload-ng PyPI | All versions to 0.5.0b3.dev88 | None |
How do I fix CVE-2025-7346?
No fix has been published for CVE-2025-7346 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-7346 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-7346 exists.
Sources
Also known as GHSA-x698-5hjm-w2m5, PYSEC-2026-1822.