CVE-2026-42313 Overview
CVE-2026-42313 is a high-severity authorization bypass vulnerability in pyLoad, an open-source download manager written in Python. The flaw resides in the set_config_value() API method located in src/pyload/core/api/__init__.py. The method relies on a hand-maintained allowlist named ADMIN_ONLY_CORE_OPTIONS to gate security-sensitive options. The allowlist protects ("proxy", "username") and ("proxy", "password") but omits ("proxy", "enabled"), ("proxy", "host"), ("proxy", "port"), and ("proxy", "type"). Any authenticated user holding the non-admin SETTINGS permission can enable proxying and redirect all outbound traffic through an attacker-controlled host. The vulnerability is fixed in version 0.5.0b3.dev100.
Critical Impact
A low-privileged authenticated user can reroute every outbound download, captcha fetch, update check, and plugin HTTP call through an attacker-controlled proxy, exposing credentials and enabling content tampering.
Affected Products
- pyLoad (pyload-ng) prior to 0.5.0b3.dev100
- Installations exposing the pyLoad web API to non-admin authenticated users
- Deployments granting the Perms.SETTINGS permission to standard users
Discovery Timeline
- 2026-05-11 - CVE-2026-42313 published to NVD
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-42313
Vulnerability Analysis
The set_config_value() API endpoint enforces authorization through a static allowlist rather than a comprehensive policy. The decorator @permission(Perms.SETTINGS) allows any user with settings privileges to invoke the method. The allowlist ADMIN_ONLY_CORE_OPTIONS is intended to escalate certain options to admin-only status, but only two of the six proxy-related configuration keys are listed. The remaining keys controlling whether the proxy is enabled, the destination host, the port, and the protocol type remain modifiable by non-admin users. This permits an attacker with SETTINGS permission to activate a proxy and direct it at an arbitrary endpoint. Once active, pyLoad routes downloads, captcha service requests, update polling, and plugin HTTP traffic through the chosen host. The classification falls under [CWE-441] (Unintended Proxy or Intermediary). This issue is a direct continuation of the fix family addressed by CVE-2026-33509, CVE-2026-35463, CVE-2026-35464, and CVE-2026-35586, each of which patched a different missed option in the same allowlist.
Root Cause
The root cause is incomplete allowlist enforcement in security-sensitive configuration handling. The pattern of manually maintaining a list of admin-only keys is fragile and has repeatedly failed to cover all proxy-related options. Authorization decisions tied to enumerated string tuples invite oversight when related configuration keys are added or refactored.
Attack Vector
An authenticated attacker with the SETTINGS permission sends API requests to set_config_value() and writes attacker-controlled values to the ("proxy", "enabled"), ("proxy", "host"), ("proxy", "port"), and ("proxy", "type") configuration entries. After the proxy is enabled, all outbound HTTP and HTTPS traffic from pyLoad transits the attacker's host. The attacker can capture credentials passed during downloads, inject malicious payloads into update or plugin responses, and observe captcha tokens.
No verified public proof-of-concept is available. Refer to the GitHub Security Advisory GHSA-pg67-9wjv-mr85 for technical details.
Detection Methods for CVE-2026-42313
Indicators of Compromise
- Unexpected changes to pyLoad proxy configuration values, particularly proxy.enabled, proxy.host, proxy.port, or proxy.type
- Outbound pyLoad traffic flowing to unfamiliar IP addresses or domains acting as intermediaries
- API audit log entries showing set_config_value() calls from non-admin accounts referencing proxy keys
Detection Strategies
- Review pyLoad configuration files and database entries for unauthorized modifications to proxy settings
- Inspect web access logs for API calls to set_config_value originating from accounts without admin role
- Compare current proxy configuration against a known-good baseline after deployment
Monitoring Recommendations
- Alert on any change to proxy-related configuration keys regardless of source user
- Monitor outbound network connections from pyLoad hosts and flag destinations outside the expected download source set
- Track authentication events for accounts holding the SETTINGS permission and correlate with configuration changes
How to Mitigate CVE-2026-42313
Immediate Actions Required
- Upgrade pyLoad to version 0.5.0b3.dev100 or later without delay
- Audit existing proxy configuration values and reset any unrecognized entries to defaults
- Review user accounts with the SETTINGS permission and revoke it where not strictly required
Patch Information
The vulnerability is fixed in pyLoad 0.5.0b3.dev100. The patch extends ADMIN_ONLY_CORE_OPTIONS to include the missing proxy keys. Details are documented in the pyLoad GitHub Security Advisory GHSA-pg67-9wjv-mr85.
Workarounds
- Restrict the SETTINGS permission to administrators only until the upgrade is applied
- Place pyLoad behind a network egress filter that blocks outbound connections to unapproved hosts
- Disable the web API or limit access to trusted source IP addresses
# Upgrade pyLoad to the fixed version
pip install --upgrade 'pyload-ng>=0.5.0b3.dev100'
# Verify the installed version
pyload --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
