MEDIUM

CVE-2026-54254

2026-09-15 CVSS v4.0

CVSS

5.9

Description

Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring the input host to be an exact member of SUPPORTED_DOMAINS, and then reuses that input host for API requests. When a Pixeldrain API key is configured, processing a crafted URL from an attacker-controlled lookalike host causes cyberdrop_dl/crawlers/pixeldrain.py to send the Authorization header to that host. The URL may be introduced through a third-party site that can cause downloads for other sites, and the attacker receives the user's Pixeldrain API key. This issue is fixed in version 9.14.0.

Weakness (CWE)

CWE-20 Improper Input Validation

CWE-200 Information Exposure

EPSS Score

0.32%

Probability of exploitation in next 30 days

25.3th percentile

References

https://github.com/Cyberdrop-DL/cyberdrop-dl/commit/4479555ae3f9d56d7657d6179a5bac3123eb4e2b https://github.com/Cyberdrop-DL/cyberdrop-dl/pull/1944 https://github.com/Cyberdrop-DL/cyberdrop-dl/releases/tag/9.14.0 https://github.com/Cyberdrop-DL/cyberdrop-dl/security/advisories/GHSA-f5pf-q7c7-m3vv

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE