CVE-2026-35187: SSRF in pyLoad Download Manager

The SSRF vulnerability in pyLoad allows an authenticated attacker to initiate server-side requests to any URL, bypassing typical security controls. This can lead to several severe consequences. Attackers can access internal network resources that are not directly exposed to the internet, potentially including databases, configuration files, and other sensitive systems. The ability to use protocols like file://, gopher://, and dict:// expands the attack surface, enabling attackers to read local files on the server, interact with internal services, and even enumerate file existence. Exploitation could reveal credentials, compromise internal systems, or facilitate further attacks within the network.

1. Reserved2026-04-01
2. Published2026-04-06
3. Modified2026-04-07
4. EPSS updated2026-04-14

The primary mitigation for CVE-2026-35187 is to upgrade pyLoad to version 0.5.0b3.dev96 or later, which includes the necessary URL validation and protocol restriction fixes. If upgrading immediately is not possible, consider implementing temporary workarounds. Restrict access to the pyLoad API endpoint to only authorized users. Implement a Web Application Firewall (WAF) with rules to block requests to suspicious URLs or protocols. Carefully review and restrict the permissions granted to authenticated users within pyLoad, limiting their ability to add new URLs. Monitor pyLoad logs for unusual outbound requests that might indicate exploitation attempts.