The vulnerability lies in pyLoad’s set_config_value() API, which incorrectly filters security-sensitive options with a manual allowlist. Users possessing the SETTINGS permission but not admin rights can enable the proxy, specify the host, port and type, and effectively reroute all pyLoad outbound traffic through an attacker‑controlled proxy. This exposes sensitive data such as download URLs, captcha submissions, update checks and plugin HTTP requests to the attacker, enabling data exfiltration, credential theft and possibly remote code execution if the attacker serves malicious content. The weakness is categorized by CWE-441, CWE-863 and CWE-918.

pyLoad installations versioned before 0.5.0b3.dev100 are affected. Any user granted non‑admin SETTINGS permission on those deployments can trigger the flaw. The upstream pyload project is the vendor, and the fix is distributed in the 0.5.0b3.dev100 release.

The CVSS score of 8.3 classifies the vulnerability as high severity. EPSS data is unavailable, but the flaw is exploitable by any authenticated non‑admin user who can call the set_config_value() API, a common operation in regular pyLoad usage. Since the bug allows an attacker to redirect all external traffic, the risk of credential compromise or interception is significant. The vulnerability is not listed in CISA’s KEV catalog, but the high impact and wide user base warrant immediate attention. The most likely attack vector is through the privileged API call, which the affected users can perform from any client with authentication to the pyLoad instance.