CVE-2026-35459

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-2026-33992 added IP validation to BaseDownloader.download() that checks the hostname of the initial download URL. However, pycurl is configured with FOLLOWLOCATION=1 and MAXREDIRS=10, causing it to automatically follow HTTP redirects. Redirect targets are never validated against the SSRF filter. An authenticated user with ADD permission can bypass the SSRF fix by submitting a URL that redirects to an internal address.

• CWE-918

• https://github.com/pyload/pyload/commit/33c55da084320430edfd941b60e3da0eb1be9443Patch
• https://github.com/pyload/pyload/security/advisories/GHSA-7gvf-3w72-p2pgExploit, Mitigation, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35452WWBN AVideo is an open source video platform. In versions 26…5.3
• CVE-2026-35453PhpSpreadsheet is a library for reading and writing spreadsh…5.4
• CVE-2026-35454The Code Extension Marketplace is an open-source alternative…6.5
• CVE-2026-35455immich is a high performance self-hosted photo and video man…5.4
• CVE-2026-35457libp2p-rust is the official rust language Implementation of …8.2
• CVE-2026-35458Gotenberg is an API for converting document formats. In 8.29…9.8
• CVE-2026-3546The e-shot form builder plugin for WordPress is vulnerable t…5.3
• CVE-2026-35460Papra is a minimalistic document management and archiving pl…5.4
• CVE-2026-35461Papra is a minimalistic document management and archiving pl…4.3
• CVE-2026-35462Papra is a minimalistic document management and archiving pl…4.3
• CVE-2026-35463pyLoad is a free and open-source download manager written in…8.8
• CVE-2026-35464pyLoad is a free and open-source download manager written in…7.5