# CVE-2026-48737: pyLoad pyload-ng SSRF bypass via IPv6 transition wrappers

Source: https://junglewise.ai/threats/cve-2026-48737-pyload-pyload-ng-ssrf-bypass-via-ipv6-transition-wrappers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-48737 · Severity: medium · CVSS 4.9 · Published 2026-09-15

pyLoad is a download manager that can be used to automate file downloads. A security flaw allows users with permission to add links to bypass safety checks and force the server to connect to internal network resources, such as private administrative interfaces or cloud metadata services. This could lead to the exposure of sensitive internal information or unauthorized access to local network services.

Technologies: [pyLoad Next Gen](https://junglewise.ai/threats/technologies/pyload-next-gen), [pyload-ng (PyPI)](https://junglewise.ai/threats/technologies/pyload-ng). Vendors: [pyLoad](https://junglewise.ai/threats/vendors/pyload), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-48737 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48737 being exploited in the wild.

**How severe is CVE-2026-48737?** Medium severity, with a CVSS score of 4.9, published 15 September 2026.

**Which products and versions are affected?** pyLoad Next Gen <= 0.5.0b3.dev100; pyload-ng (PyPI) <= 0.5.0b3.dev100, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.dev100.

**Is there a fix for CVE-2026-48737?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48737 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48737?** Check whether you run pyLoad Next Gen or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in pyLoad due to an incomplete IP address validation logic in the is_global_address function. The application relies on Python's ipaddress.IPv6Address.is_global check, which incorrectly identifies IPv6 transition prefixes (such as 6to4 and NAT64) as globally routable even when they wrap internal IPv4 addresses (e.g., 127.0.0.1 or 169.254.169.254). An attacker with 'Perms.ADD' privileges can provide a specially crafted IPv6 literal or a hostname with a malicious AAAA record to bypass the SSRF guard. This allows the attacker to perform internal network reconnaissance or exfiltrate cloud metadata. The vulnerability is present in pyload-ng up to version 0.5.0b3.dev100.

## Affected products

- pyLoad pyload-ng <= 0.5.0b3.dev100

## Identifiers

- CVE-2026-48737
- GHSA-m5x5-28jr-gpjj
- PYSEC-2026-2995

## Timeline

- 2026-07-08: disclosed
- 2026-07-09: advisory

## References

- [https://api.github.com/users/tonghuaroot](https://api.github.com/users/tonghuaroot)
- [https://github.com/tonghuaroot](https://github.com/tonghuaroot)
- [https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D](https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D)
- [https://api.github.com/users/tonghuaroot/repos](https://api.github.com/users/tonghuaroot/repos)
- [https://avatars.githubusercontent.com/u/23011166?v=4](https://avatars.githubusercontent.com/u/23011166?v=4)
- [https://api.github.com/users/tonghuaroot/events%7B/privacy%7D](https://api.github.com/users/tonghuaroot/events%7B/privacy%7D)

## Related threats

- [pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses)
- [pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service)
- [pyload-ng authentication bypass in getUserData/get_userdata](https://junglewise.ai/threats/pyload-ng-getuserdata-get-userdata-exposed-at-perms-any-allow-any-cd197c9d)
- [pyLoad rate-limit bypass and audit-log spoofing via X-Forwarded-For header](https://junglewise.ai/threats/pyload-rate-limit-bypass-and-audit-log-spoofing-via-trusted-client-0df0fd12)
- [pyLoad session invalidation bypass in privilege revocation and password change](https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba)