← Vulnerability feed

Vulnerability record · CVE-2026-35187 · published 6 April 2026

CVE-2026-35187: Pyload-ng project pyload-ng server-side request forgery (ssrf) vulnerability

PPyload Ng Project · Pyload Ng

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints, read local files via file:// protocol (pycurl reads the file server-side), interact with internal services via gopher:// and dict:// protocols, and enumerate file existence via error-based oracle (error 37 vs empty response).

7.7 CVSS 3.1 High EPSS 0.37% · top 72.2% CWE-918 · Server-side request forgery (SSRF)
7.7CVSS 3.1 base score
0.37%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
24 Jul 2026Last modified by NVD

Description

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints, read local files via file:// protocol (pycurl reads the file server-side), interact with internal services via gopher:// and dict:// protocols, and enumerate file existence via error-based oracle (error 37 vs empty response).

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pyload/pyload/commit/4032e57d61d8f864e39f4dcfdb567527a50a9e1f Patch
https://github.com/pyload/pyload/security/advisories/GHSA-2wvg-62qm-gj33 ExploitMitigationVendor Advisory
https://github.com/pyload/pyload/security/advisories/GHSA-2wvg-62qm-gj33 ExploitMitigationVendor Advisory

Track CVE-2026-35187 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-54802Pyload-ng project pyload-ng path traversal vulnerabilitypyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path tra…EPSS 1.2%9.3CVE-2026-35459Pyload-ng project pyload-ng server-side request forgery (ssrf) vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vu…EPSS 0.38%8.8CVE-2026-35463Pyload-ng project pyload-ng os command injection vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restri…EPSS 0.91%8.8CVE-2026-33509Pyload improper privilege management vulnerabilitypyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API e…EPSS 0.58%8.8CVE-2026-33511Pyload insecure direct object reference vulnerabilitypyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator i…EPSS 0.62%8.8CVE-2024-22416Pyload-ng project pyload-ng cross-site request forgery vulnerabilitypyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since t…EPSS 0.95%8.3CVE-2026-42313Pyload-ng project pyload-ng incorrect authorization vulnerabilitypyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SE…EPSS 0.39%8.1CVE-2026-32808Pyload path traversal vulnerabilitypyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password v…EPSS 0.46%

Source: NIST National Vulnerability Database (record CVE-2026-35187), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.