CVE-2026-35459
pyLoad, a free download manager, has a server‑side request forgery flaw that lets an authenticated user trick the system into fetching internal network resources. The problem occurs when a user submits a URL that redirects to an internal address, bypassing the IP check added in a previous patch.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
pyLoad (pyload‑ng_project pyload‑ng) versions 0.5.0b3.dev96 and earlier. Users who run these versions and grant ADD permission to authenticated users are at risk.
Real-world impact
An attacker could cause the pyLoad server to access internal services or files, potentially exposing sensitive data or enabling further attacks inside the network.
Why this severity
The CVSS score of 9.3 reflects the high impact on confidentiality and integrity, the low attack complexity, and the fact that no user interaction is required. The flaw allows an attacker to read or modify internal resources through the server.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 6, 2026 · Apr 6, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/pyload/pyload/commit/33c55d…patch
- github.com/pyload/pyload/security/advi…exploitmitigationvendor advisory