cve.bz

CVE-2026-33992

9.3 criticalEPSS 0.4%

Critical (9.3) in pyload pyload. EPSS 0.4% chance of exploitation in the next 30 days.

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive infrastructure data including droplet ID, network configuration, region, authentication keys, and SSH keys configured in user-data/cloud-init. Version 0.5.0b3.dev97 contains a patch.

Severity

CVSS 4.0

9.3 critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
CWE
CWE-918
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-m74m-f7cr-432xPyPIpyload-ng<=0.5.0b3.dev96no fix published
PYSEC-2026-497PyPIpyload-ng<=0.5.0b3.dev96no fix published

References

Check your stackJSON