Executive brief
pyLoad is a download manager that can be used to automate file downloads. A security flaw allows users with permission to add links to bypass safety checks and force the server to connect to internal network resources, such as private administrative interfaces or cloud metadata services. This could lead to the exposure of sensitive internal information or unauthorized access to local network services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in pyLoad due to an incomplete IP address validation logic in the is_global_address function. The application relies on Python's ipaddress.IPv6Address.is_global check, which incorrectly identifies IPv6 transition prefixes (such as 6to4 and NAT64) as globally routable even when they wrap internal IPv4 addresses (e.g., 127.0.0.1 or 169.254.169.254). An attacker with 'Perms.ADD' privileges can provide a specially crafted IPv6 literal or a hostname with a malicious AAAA record to bypass the SSRF guard. This allows the attacker to perform internal network reconnaissance or exfiltrate cloud metadata. The vulnerability is present in pyload-ng up to version 0.5.0b3.dev100.
Affected products
- pyLoad pyload-ng <= 0.5.0b3.dev100
Timeline
- 2026-07-08: disclosed
- 2026-07-09: advisory