CVSS 3.1
7.7 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NCVE-2026-35187
High (7.7) in pyload-ng project pyload-ng. EPSS 0.3% chance of exploitation in the next 30 days.
pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints, read local files via file:// protocol (pycurl reads the file server-side), interact with internal services via gopher:// and dict:// protocols, and enumerate file existence via error-based oracle (error 37 vs empty response).
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pyload-ng_project:pyload-ng
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2wvg-62qm-gj33 | PyPI | pyload-ng | <=0.5.0b3.dev96 | no fix published |
| PYSEC-2026-2988 | PyPI | pyload-ng | <=0.5.0b3.dev96 | no fix published |