Description
pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-2026-33992 added IP validation to BaseDownloader.download() that checks the hostname of the initial download URL. However, pycurl is configured with FOLLOWLOCATION=1 and MAXREDIRS=10, causing it to automatically follow HTTP redirects. Redirect targets are never validated against the SSRF filter. An authenticated user with ADD permission can bypass the SSRF fix by submitting a URL that redirects to an internal address.
References (2)
Core 2
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/pyload/pyload/security/advisories/GHSA-7gvf-3w72-p2pg
X_Refsource_Misc x_refsource_misc
https://github.com/pyload/pyload/commit/33c55da084320430edfd941b60e3da0eb1be9443
Scores
CVSS v3
9.1
EPSS
0.0028
EPSS Percentile
19.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-918
Status
published
Products (3)
pyload/pyload
<= 0.5.0b3.dev96
pyload-ng_project/pyload-ng
< 0.5.0b3.dev97
pypi/pyload-ng
0PyPI
Published
Apr 06, 2026
Tracked Since
Apr 07, 2026