Pyload-ng Unrestricted Proxy Config Leads to Outbound Traffic Redirection (CVE-2026-33509)

Vulnerability Overview Vulnerability Name: pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted config CVE Number: CVE-2026-33509, CVE-2026-35463, CVE-2026-35464, CVE-2026-35586 Severity: High (CVSS v3 base metrics: 8.3 / 10) Description: This vulnerability allows non-administrator users to redirect all outbound traffic to an attacker-controlled proxy server by setting configuration items. The vulnerability exists in the method in . This method exposes security-sensitive options to users with privileges but fails to properly restrict related configurations. An attacker can exploit this vulnerability to intercept and modify all outbound HTTP requests, including downloads, update checks, and plugin invocations. Impact Scope Affected Versions: <= 0.5.0b3.dev99 Fixed Version: 0.5.0b3.dev100 Impacted Users: Any non-administrator user with privileges Potential Risks: - All outbound HTTP traffic (including embedded URLs, headers, cookies, download session IDs, request bodies, and response bodies) can be intercepted and modified. - Theft of cookies or Bearer tokens from any download session. - Arbitrary code injection into the plugin pipeline via malicious files. - Arbitrary content injection into the anti-spam solver. - Combined with the vulnerability, this allows complete control over HTTPS traffic. Remediation Upgrade Version: Upgrade to version 0.5.0b3.dev100 or higher. Temporary Mitigation: If an immediate upgrade is not possible, it is recommended to restrict the privileges of non-administrator users to prevent them from modifying configurations. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Pyload-ng Unrestricted Proxy Config Leads to Outbound Traffic Redirection (CVE-2026-33509)

More from this source