CVE-2026-123814

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/save_config by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in src/pyload/plugins/addons/WindowsPhoneNotify.py then uses http.client.HTTPConnection without pyLoad's pycurl destination validation. When a download completes, the global notification event causes a blind POST from the pyLoad server to the attacker-selected internal host, port, and path. The response is not returned, but the request can probe internal services, reach cloud metadata endpoints, or trigger state-changing internal HTTP endpoints. This issue is fixed in version 0.5.0b3.dev102.

• CWE-918

• https://github.com/pyload/pyload/commit/989a551d2ae0c00b0d2c7baf6d850180c9b46559
• https://github.com/pyload/pyload/security/advisories/GHSA-p3pr-8f3m-4qp8

Published

Nov 9, 2026

Last Modified

Nov 10, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123808Nuxt UI is an intuitive Vue UI library powered by Reka UI an…5.3
• CVE-2026-123809Dynatrace MCP Server is an MCP server for Dynatrace Observab…4.2
• CVE-2026-123810Dynatrace MCP Server is an MCP server for Dynatrace Observab…4.3
• CVE-2026-123811Dynatrace MCP Server is an MCP server for Dynatrace Observab…7.5
• CVE-2026-123812Dynatrace MCP Server is an MCP server for Dynatrace Observab…3.7
• CVE-2026-123813pyLoad is a free and open-source download manager written in…7.5
• CVE-2026-123815pyLoad is a free and open-source download manager written in…9.4
• CVE-2026-123816pyLoad is a free and open-source download manager written in…8.1
• CVE-2026-123817AIOHTTP is an asynchronous HTTP client/server framework for …8.7
• CVE-2026-123818LMDeploy is a toolkit for compressing, deploying, and servin…7.5
• CVE-2026-123819Wagtail is an open source content management system built on…6.5
• CVE-2026-12382A flaw was found in the AAP Gateway Envoy proxy configuratio…8.2