CVE-2026-35187 Details
Description
pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints, read local files via file:// protocol (pycurl reads the file server-side), interact with internal services via gopher:// and dict:// protocols, and enumerate file existence via error-based oracle (error 37 vs empty response).
A server-side request forgery (SSRF) vulnerability has been identified in pyLoad versions through 0.5.0b3.dev96. The issue arises in the parse_urls API function, which fetches arbitrary URLs via the get_url function using pycurl, without any validation, protocol restrictions, or IP blacklisting. This vulnerability allows authenticated users with ADD permission to make HTTP or HTTPS requests to internal network resources and cloud metadata endpoints, read local files using the file:// protocol, interact with internal services via gopher:// and dict:// protocols, and enumerate the existence of files through an error-based oracle.
Users are advised to update to pyLoad version 0.5.0b3.dev97, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pyload/pyload/security/advisories/GHSA-2wvg-62qm-gj33 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/pyload/pyload/commit/4032e57d61d8f864e39f4dcfdb567527a50a9e1f | [email protected] | Patch |
| https://github.com/pyload/pyload/security/advisories/GHSA-2wvg-62qm-gj33 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pyload-ng project pyload-ng | < 0.5.0b3.dev97 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | New CVE Received | [email protected] |