CVE-2025-55156

Advisory

Affected versions of the pyload-ng package are vulnerable to SQL Injection due to unsanitized concatenation of user-controlled input into a database query. The /json/add_package API path propagates the add_links parameter to src/pyload/core/database/file_database.py:update_link_info, which constructs a comma-separated list of URLs and interpolates it directly into SELECT id FROM links WHERE url IN ('{statuses}') rather than using parameterised placeholders, allowing crafted values to alter the SQL syntax. An authenticated attacker can send a POST request to /json/add_package with a malicious add_links value that terminates the string literal and injects arbitrary SQL, enabling modification or deletion of database records and causing data loss and service disruption in pyload-ng.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f
• https://github.com/advisories/GHSA-pwh4-6r3m-j2rf
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55156