CVE-2025-55156 json
PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
published last yr. modified 4mo ago also EUVD-2025-24185 , GHSA-pwh4-6r3m-j2rf , PYSEC-2026-1821
- cvss
- 7.8
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.
Patch / fix
- pypi pyload-ng 0.5.0b3.dev91
- pyload-ng_project pyload-ng 0.5.0b3.dev91
- pyload pyload 0.5.0b3.dev91
Is CVE-2025-55156 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P |
| CNA | 4.0 | 7.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pyload-ng | <0.5.0b3.dev91 |
0.5.0b3.dev91 |
Affected products
- pyload pyload
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f
web
-
github.com
/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf
web
-
github.com
/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-55156
advisory
-
github.com
/pyload/pyload
package
-
pypi.org
/project/pyload-ng
package
-
github.com
/advisories/GHSA-pwh4-6r3m-j2rf
advisory
Sources
- CVE List CVE-2025-55156
- GitHub Advisory GHSA-pwh4-6r3m-j2rf
- NVD CVE-2025-55156
- OSV PYSEC-2026-1821
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.