CVE-2026-35459
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
pyLoad in version 0.5.0b3.dev96 and earlier has an SSRF vulnerability. The fix for CVE-2026-33992 added IP validation, but pycurl automatically follows HTTP redirects and redirect targets are not validated. An authenticated user with ADD permission can bypass the SSRF filter by using a URL that redirects to an internal address.
Risk Assessment
An attacker can scan the internal network and access internal services, potentially leading to data leakage or further attacks.
Recommendation
Update to a version with a complete fix and restrict ADD permissions.
Original NVD description (English source)
pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-2026-33992 added IP validation to BaseDownloader.download() that checks the hostname of the initial download URL. However, pycurl is configured with FOLLOWLOCATION=1 and MAXREDIRS=10, causing it to automatically follow HTTP redirects. Redirect targets are never validated against the SSRF filter. An authenticated user with ADD permission can bypass the SSRF fix by submitting a URL that redirects to an internal address.