PT-2026-30319 · Pyload · Pyload

Morimori-Dev · Published 2026-04-04 · Updated 2026-04-06 · CVE-2026-35187

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pyLoad versions 0.5.0b3.dev96 and earlier

Description pyLoad, a Python-based download manager, has an issue in the parse urls API function located in src/pyload/core/api/ init .py. This function retrieves URLs server-side using get url(url) (pycurl) without validating the URL, restricting protocols, or implementing an IP blacklist. An authenticated user with ADD permission can make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints. They can also read local files via the file:// protocol, interact with internal services using gopher:// and dict:// protocols, and enumerate file existence through an error-based oracle. The get url() function is used without any restrictions, allowing access to various protocols and internal resources.

Recommendations Restrict allowed protocols and validate target addresses. Implement a function like is safe url() to check if the URL scheme is 'http' or 'https', and verify that the hostname resolves to a non-private, non-loopback, and non-reserved IP address before making the request.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-35187

GHSA-2WVG-62QM-GJ33

Affected Products

Pyload

References · 6

• 🔥 https://github.com/pyload/pyload/security/advisories/GHSA-2wvg-62qm-gj33 · Exploit
• https://github.com/pyload/pyload/commit/4032e57d61d8f864e39f4dcfdb567527a50a9e1f · Patch
• https://osv.dev/vulnerability/GHSA-2wvg-62qm-gj33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35187 · Security Note
• https://github.com/pyload/pyload · Note
• https://twitter.com/CVEnew/status/2041250715503370596 · Twitter Post