Read the docs
TI-2026-27341 Aliases CVE-2026-35187GHSA-2wvg-62qm-gj33

pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter

Priority HIGH 67CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints, read local files via file:// protocol (pycurl reads the file server-side), interact with internal services via gopher:// and dict:// protocols, and enumerate file existence via error-based oracle (error 37 vs empty response).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pyloadpyloadup to 0.5.0b3.dev96—No fix listedCNA
—pyload-ng (PyPI)up to 0.5.0b3.dev96—No fix listedGHSA-2wvg-62qm-gj33
  • pyload Vendorpyload Affected up to 0.5.0b3.dev96 Fixed in — No fix listed CNA
  • pyload-ng (PyPI) Vendor— Affected up to 0.5.0b3.dev96 Fixed in — No fix listed GHSA-2wvg-62qm-gj33

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:*before 0.5.0b3.dev97VulnerablePyload-ng Project
  • cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:* Versions before 0.5.0b3.dev97 Vulnerable ·Pyload-ng Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35187
  2. 2026-10-03 Alias added: GHSA-2wvg-62qm-gj33

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2025-34556 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
  • TI-2025-33765 pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVSS 3.1CRITICAL 9.8
  • TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2026-27589 pyLoad has SSRF fix bypass via HTTP redirect CVSS 4.0CRITICAL 9.3
  • TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences