CVE-2026-35187
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In pyLoad 0.5.0b3.dev96 and earlier, the parse_urls API function fetches arbitrary URLs server-side without validation. An authenticated user with ADD permission can read internal resources, local files (file://), and use gopher:// and dict:// protocols.
Risk Assessment
An attacker can access internal network services, cloud metadata, and local files, potentially leading to privilege escalation and data leakage.
Recommendation
Update pyLoad to the latest version and restrict ADD permissions to trusted users only.
Other vulnerabilities in pyLoad
See all- CVE-2026-42315High
In pyLoad prior to version 0.5.0b3.dev100, there is a vulnerability that allows a user with Perms.MODIFY to specify arbitrary directories as download locations for a package through the set_package_data() API function. The lack of sanitization in the '_folder' key enables this action.
- CVE-2026-42313High
In pyLoad prior to version 0.5.0b3.dev100, the set_config_value() API method improperly managed security-sensitive options, allowing authenticated users with SETTINGS permission to enable proxying and route traffic through a host they control.
- CVE-2026-35459Critical
pyLoad in version 0.5.0b3.dev96 and earlier has an SSRF vulnerability. The fix for CVE-2026-33992 added IP validation, but pycurl automatically follows HTTP redirects and redirect targets are not validated. An authenticated user with ADD permission can bypass the SSRF filter by using a URL that redirects to an internal address.
- CVE-2023-47890High
pyLoad 0.5.0 is vulnerable to unrestricted file upload, allowing an attacker to upload arbitrary files to the server without proper validation.
Original NVD description (English source)
pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints, read local files via file:// protocol (pycurl reads the file server-side), interact with internal services via gopher:// and dict:// protocols, and enumerate file existence via error-based oracle (error 37 vs empty response).