The pyload-ng download manager includes a Host Header Spoofing weakness in the @local_check decorator. An unauthenticated external attacker can supply a forged Host header to bypass the intended local‑only restriction, exposing the Click'N'Load API endpoints. Through these endpoints the attacker can trigger arbitrary download requests to remote resources, which results in Server‑Side Request Forgery (SSRF) and can lead to Denial of Service conditions on the host. This vulnerability is rooted in Weak Authentication (CWE‑287) and Improper Origin Validation (CWE‑346).

pyload-ng, the open‑source download manager, is affected for all releases older than 0.5.0b3.dev97. Vulnerable installations run the Python implementation of the tool and have not applied the official patch that addresses the host‑header validation flaw.

The CVSS v3.1 score of 6.5 indicates a medium severity risk. With an EPSS probability of less than 1%, the likelihood of widespread exploitation is low, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending HTTP requests with a spoofed Host header from an external network, targeting the /clicknload API endpoints. No user authentication or elevated privileges are required, and the impact includes the ability to force the service to download arbitrary data and potentially disrupt service availability.