CVE-2026-35187: pyload-ng SSRF Vulnerability in parse_urls API Endpoint
Summary
CVE-2026-35187: pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter. Affects pyload-ng versions < 0.5.0b3.dev96. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyload-ng is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It provides features like support for multiple file hosting services, a web interface, and plugin support. However, it has a critical vulnerability in its parse_urls API endpoint, which can be exploited by authenticated users to perform unauthorized actions.
Vulnerability Detail
The vulnerability arises from a Server-Side Request Forgery (SSRF) in the parse_urls API function located in src/pyload/core/api/init.py. The function fetches arbitrary URLs without any validation, allowing an authenticated user with ADD permission to make HTTP/HTTPS requests to internal network resources, read local files via the file:// protocol, and interact with internal services using gopher:// and dict:// protocols. This can lead to significant security risks, including data exfiltration, internal service interaction, and unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the parse_urls API endpoint to trusted users only, and monitor the usage of the API to detect any suspicious activity. Additionally, consider implementing network-level controls to limit access to internal resources.
Conclusion
The SSRF vulnerability in the pyload-ng package poses significant risks to users, allowing unauthorized access and potential data breaches. It is crucial to update to the latest version and implement recommended security measures to mitigate these risks.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2026-35187 is a vulnerability in the pyload-ng package that allows authenticated users to exploit the parse_urls API endpoint for unauthorized actions, including SSRF attacks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring installation.
The risks include unauthorized access to internal services, data exfiltration, and the ability to read local files, which can lead to significant security breaches.
You can update pyload-ng by running the command: pip install --upgrade pyload-ng. Ensure you are using version 0.5.0b4 or later.
The CVSS score of this vulnerability is 7.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
