CVE-2026-48737

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user can submit an IPv6 literal through parse_urls to the pre-resolution is_global_host guard. Because host_to_ip is pinned to AF_INET, that guard does not evaluate a hostname's AAAA result. Separately, curl resolves hostnames before the pycurl PREREQFUNC in src/pyload/core/network/http/http_request.py applies the same vulnerable is_global_address check to the actual connection address, so a transition-form AAAA result can be permitted even when it terminates at an embedded loopback, private, CGNAT, or link-local IPv4 address. Exploitation requires the pyLoad host to route the applicable transition mechanism, including 6to4 on affected Python 3.9 through 3.11 deployments or NAT64 on a network with a NAT64 gateway. Successful exploitation can enable internal-network reconnaissance, timing-based confirmation, limited service disruption, or cloud metadata disclosure where the wrapped address is routable. This issue is fixed in version 0.5.0b3.dev101.

• CWE-918

• https://github.com/pyload/pyload/commit/ba7491046b2d430732be490913e4cbf1f1e899c2
• https://github.com/pyload/pyload/security/advisories/GHSA-m5x5-28jr-gpjj
• https://github.com/pyload/pyload/security/advisories/GHSA-m5x5-28jr-gpjj

Published

Sep 15, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48731Warp is an agentic development environment. From 0.2024.02.2…7.8
• CVE-2026-48732Warp is an agentic development environment. From 0.2023.03.2…8.8
• CVE-2026-48733ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-48734ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-48735pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-48736Symfony is a PHP framework for web and console applications …8.6
• CVE-2026-4874A flaw was found in Keycloak. An authenticated attacker can …3.1
• CVE-2026-48743Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-48744Saleor is an e-commerce platform. From 3.14.67 until 3.21.67…6.5
• CVE-2026-48745Traccar Client is a GPS tracking mobile app for sending loca…9.3
• CVE-2026-48746vLLM is an inference and serving engine for large language m…9.1
• CVE-2026-48747Symfony is a PHP framework for web and console applications …5.3