CVE-2026-35187

HIGH 7.7

pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

8th

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints, read local files via file:// protocol (pycurl reads the file server-side), interact with internal services via gopher:// and dict:// protocols, and enumerate file existence via error-based oracle (error 37 vs empty response).

CWE	CWE-918
Vendor	pyload
Product	pyload
Published	Apr 6, 2026
Last Updated	Apr 7, 2026

Stay Ahead of the Next One

Get instant alerts for pyload pyload

Be the first to know when new high vulnerabilities affecting pyload pyload are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

pyload / pyload

<= 0.5.0b3.dev96

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pyload/pyload/security/advisories/GHSA-2wvg-62qm-gj33 github.com: https://github.com/pyload/pyload/commit/4032e57d61d8f864e39f4dcfdb567527a50a9e1f