critical9.1
CVE-2026-35459
pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)
Impact
pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-2026-33992 added IP validation to BaseDownloader.download() that checks the hostname of the initial download URL. However, pycurl is configured with FOLLOWLOCATION=1 and MAXREDIRS=10, causing it to automatically follow HTTP redirects. Redirect targets are never validated against the SSRF filter. An authenticated user with ADD permission can bypass the SSRF fix by submitting a URL that redirects to an internal address.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pyload-ng | <= 0.5.0b3.dev96 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pyload-Ng Project | Pyload-Ng | before 0.5.0b3.dev97 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-7gvf-3w72-p2pg
- https://github.com/pyload/pyload/security/advisories/GHSA-7gvf-3w72-p2pg
- https://nvd.nist.gov/vuln/detail/CVE-2026-33992
- https://nvd.nist.gov/vuln/detail/CVE-2026-35459
- https://github.com/pyload/pyload/commit/33c55da084320430edfd941b60e3da0eb1be9443