CVE Feed

    Dashboard / CVE / CVE-2026-35459

    CVE-2026-35459

    pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-2026-33992 added IP validation to BaseDownloader.download() that checks the hostname of the initial download URL. However, pycurl is configured with FOLLOWLOCATION=1 and MAXREDIRS=10, causing it to automatically follow HTTP redirects. Redirect targets are never validated against the SSRF filter. An authenticated user with ADD permission can bypass the SSRF fix by submitting a URL that redirects to an internal address.

    Published:Apr 6, 2026
    Last Modified:Apr 20, 2026
    EPS:Apr 6, 2026
    EPSS Score:0.00033
    CVSS Score:9.1

    Affected Products

    Vendor
    Pyload
    Product
    Pyload
    Vendor
    Pyload-ng Project
    Product
    Pyload-ng

    Exploits

    https://github.com/pyload/pyload/security/advisories/GHSA-7gvf-3w72-p2pg

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-45306 (CVSS 6.5) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-…
    CVE-2026-45348 (CVSS 8.7) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js …
    CVE-2026-46561 (CVSS 5) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the PREREQFUNCTI…
    CVE-2026-44226 (CVSS 5.3) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI …
    CVE-2026-42315 (CVSS 8.1) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a f…
    CVE-2026-42314 (CVSS 6.5) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder n…
    CVE-2026-42312 (CVSS 6.8) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_v…
    CVE-2026-42313 (CVSS 8.3) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_v…
    CVE-2026-41133 (CVSS 8.8) — pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev9…
    CVE-2026-40594 (CVSS 4.8) — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_c…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High