CVE-2026-35187
- Source
- https://cve.org/CVERecord?id=CVE-2026-35187
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35187.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-35187
- Aliases
- Published
- 2026-04-06T19:33:06.557Z
- Modified
- 2026-07-08T08:12:58.672138304Z
- Severity
-
- 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter
- Details
-
pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parseurls API function in src/pyload/core/api/init.py fetches arbitrary URLs server-side via geturl(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints, read local files via file:// protocol (pycurl reads the file server-side), interact with internal services via gopher:// and dict:// protocols, and enumerate file existence via error-based oracle (error 37 vs empty response).
- Database specific
{ "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "last_affected": "0.5.0b3.dev96" } ] } ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35187.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-918" ] }- References