SHSelfHostIndex

pyLoad

Lightweight, extensible download manager with a web UI

Automation & Workflows ★ 3.9k stars Easy setup AGPL-3.0

pyLoad is an open-source, lightweight download manager that automates fetching files from many file hosters. It runs as a self-hosted service with a web interface and supports plugins and scheduling.

Official siteSource code

Key features

  • Automated downloads
  • Web interface
  • Plugin system
  • Lightweight

Strengths

  • Released under the AGPL-3.0 license
  • Easy to set up — beginner-friendly
  • First-class Docker support for quick deployment
  • Active community (3.9k GitHub stars)

Is pyLoad secure?

No confirmed vulnerabilities affect pyLoad's latest release (v0.4.x). OSV.dev lists 33 advisories for the project and links 30 of them to this release, but their version data doesn't confirm them. No known vulnerabilities is not proof of security: it means none have been publicly catalogued.

30 unconfirmed matches

OSV.dev links these advisories to this release, but their own version data doesn't confirm it: they cover a separately versioned sub-package of the repository, or record the fix only as a commit. They are listed for completeness and not counted in the health score.

Matched by OSV, not confirmed

AdvisorySeveritySummary
CVE-2023-0297CriticalCode Injection in pyload/pyload
CVE-2025-53890CriticalpyLoad vulnerable to remote code execution through js2py onCaptchaResult
CVE-2025-54802CriticalpyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)
CVE-2023-0488CriticalCross-site Scripting (XSS) - Stored in pyload/pyload
CVE-2024-22416CriticalCross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
CVE-2026-33992CriticalpyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
CVE-2026-35459CriticalpyLoad has SSRF fix bypass via HTTP redirect
CVE-2026-33511Highpyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad
CVE-2026-35463HighpyLoad has Improper Neutralization of Special Elements used in an OS Command
CVE-2026-41133HighpyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

Showing 10 of 30.

  • Most recent fixed advisory CVE-2026-33509, published 2026-03-24 (204 days ago)

Source: OSV.dev, checked 2026-10-14. How this is measured.

pyLoad replaces

Self-hosted JDownloader alternatives

Health badge

Maintain pyLoad? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 86 · excellent

Markdown
[![SelfHostIndex health score for pyLoad](https://selfhostindex.com/badge/pyload-ng.svg)](https://selfhostindex.com/app/pyload-ng/)
HTML
<a href="https://selfhostindex.com/app/pyload-ng/"><img src="https://selfhostindex.com/badge/pyload-ng.svg" alt="SelfHostIndex health score for pyLoad"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/pyload-ng.svg
   :alt: SelfHostIndex health score for pyLoad
   :target: https://selfhostindex.com/app/pyload-ng/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Similar automation & workflows apps