PT-2026-42682 · Pyload · Pyload

Offset · Published 2026-05-21 · Updated 2026-05-28 · CVE-2026-46561

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev100

Description An authenticated attacker can perform Server-Side Request Forgery (SSRF) by supplying a URL to the 'parse urls' API endpoint that points to a server under their control. This server can respond with a 302 redirect to an internal or private IP address, bypassing the is global host() check performed on the initial URL. This occurs because the HTTPRequest class, used by the get url() function, has the allow private ip variable set to True by default, which causes the pre request callback() function to skip the private IP validation during redirects.

This issue can be exploited to access internal services on private networks, localhost services, or cloud metadata endpoints (such as AWS IMDSv1), potentially leaking IAM credentials, instance metadata, and secrets.

Recommendations Update to version 0.5.0b3.dev100 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-46561

GHSA-8RP3-XC6W-5QP5

Affected Products

Pyload

References · 7

• 🔥 https://github.com/pyload/pyload/security/advisories/GHSA-8rp3-xc6w-5qp5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46561 · Security Note
• https://osv.dev/vulnerability/GHSA-8rp3-xc6w-5qp5 · Vendor Advisory
• https://github.com/pyload/pyload · Note
• https://twitter.com/VulmonFeeds/status/2060092335606685728 · Twitter Post
• https://twitter.com/infoflowcloud/status/2060093001079140656 · Twitter Post
• https://twitter.com/CVEnew/status/2060091979422167458 · Twitter Post