A flaw in pyLoad’s ClickNLoad feature permits an unauthenticated attacker to override the local_check decorator by sending a request with a forged HTTP Host header. This bypass opens localhost‑restricted endpoints, allowing the attacker to inject arbitrary downloads, write files to the storage directory, and run JavaScript code, effectively enabling remote code execution on the target system.

The vulnerability affects the pyLoad download manager from versions 0.4.20 up to, but not including, 0.5.0b3.dev97. The affected product is the open‑source pyLoad application.

The flaw carries a CVSS score of 8.8, indicating high severity, and a very low EPSS score of less than 1%, suggesting the likelihood of public exploitation is minimal. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that a remote attacker can exploit the issue by sending a crafted HTTP request with a spoofed Host header to the server, thereby gaining unauthenticated access to restricted endpoints.