CVE-2024-22416: Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.9%, percentile 61: FIRST’s model estimates a 0.9% chance of exploitation activity in the next 30 days, higher than 61% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Only applies if your dependency tree includes pyload-ng (PyPI) < 0.5.0b3.dev78, fixed in 0.5.0b3.dev78. Check your lockfile, including transitive dependencies.

What it is

pyLoad is a free and open-source Download Manager written in pure Python. The pyload API allows any API call to be made using GET requests. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release 0.5.0b3.dev78. All users are advised to upgrade.

From the GitHub advisory

Summary The pyload API allows any API call to be made using GET requests. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. This proof of concept shows how an unauthenticated user could trick the administrator's browser into creating a new admin user.

PoC We host the following HTML file on an attacker-controlled server.

If we now trick an administrator into visiting our malicious page at https://attacker.com/CSRF.html, we see that their browser will make a request to /api/adduser/%22hacker%22,%22hacker%22, adding a new administrator to the pyload application.

The attacker can now authenticate as this newly created administrator user with the username hacker and password hacker.

Impact Any API call can be made via a CSRF attack by an unauthenticated user.

Weakness type: CWE-352.

Product: pyload-ng (PyPI) · Assigned by: GitHub_M · Published: 2024-01-17

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: none
• Privileges required: none (no login)
• User interaction: passive

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
• FIRST EPSS (model of 2026-10-21): 0.95% probability of exploitation activity in the next 30 days; percentile 61.

Timeline

• 2024-01-17 — CVE record published by GitHub_M
• 2024-01-19 — GitHub-reviewed advisory GHSA-pgpj-v85q-h5fm published (critical)
• 2025-06-17 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-pgpj-v85q-h5fm github.com
2. CVE.org record CVE-2024-22416 cve.org
3. NVD entry CVE-2024-22416 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com

Critical PyPI advisories · Today’s Security Digest