pyLoad version prior to 0.5.0b3.dev76 is affected by an Improper Access Control vulnerability. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. An attacker can leverage this vulnerability to perform further attacks against the application.

pyLoad 版本在 0.5.0b3.dev76 之前，受到不當存取控制（Improper Access Control）漏洞的影響。任何未認證的使用者都可以瀏覽特定網址，以暴露 Flask 設定，包括「SECRET_KEY」變數。攻擊者可利用此弱點對應用程式發動進一步攻擊。

pyLoadバージョン(0.5.0b3.dev76以前)は、不適切なアクセス制御(Improper Access Control)の脆弱性の影響を受けています。認証されていないユーザーは特定のURLにアクセスしてFlaskの設定('SECRET_KEY'変数を含む)を公開できます。攻撃者がこの脆弱性を悪用して、アプリケーションに対してさらなる攻撃を実行する可能性があります。

pyLoad 版本在 0.5.0b3.dev76 之前受到不当访问控制（Improper Access Control）漏洞的影响。任何未认证的用户都可以浏览到特定URL以暴露Flask配置，包括“SECRET_KEY”变量。攻击者可利用此漏洞，针对应用程序执行进一步攻击。

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can
    browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has
    been patched in version 0.5.0b3.dev77. (CVE-2024-21644)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
114978	pyLoad < 0.5.0b3.dev76 Improper Access Control	Web App Scanning	Component Vulnerability	2025/10/3	2025/10/3	high
114978	pyLoad < 0.5.0b3.dev76 存取控制不當	Web App Scanning	Component Vulnerability	2025/10/3	2025/10/3	high
114978	pyLoad < 0.5.0b3.dev76 不適切なアクセス制御	Web App Scanning	Component Vulnerability	2025/10/3	2025/10/3	high
114978	pyLoad < 0.5.0b3.dev76 访问控制不当	Web App Scanning	Component Vulnerability	2025/10/3	2025/10/3	high
417097	SCA: security update for pyload-ng (GHSA-mqpq-2p68-46fv)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	high
417097	SCA: security update for pyload-ng (GHSA-mqpq-2p68-46fv)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	high

检测

插件搜索

high

high

high

high

high

high