CVE-2026-35187

CVE-2026-35187 is a server-side request forgery (SSRF) vulnerability in pyLoad, a free and open-source download manager written in Python. Affected versions include 0.5.0b3.dev96 and earlier. The vulnerability exists in the parse_urls API function, which fails to validate URLs before fetching them server-side, allowing authenticated users with ADD permission to make arbitrary HTTP/HTTPS requests to internal network resources, cloud metadata endpoints, and local files via protocols including file://, gopher://, and dict://. The vulnerability carries a CVSS score of 7.7 (HIGH) with a network attack vector, low complexity, and low privilege requirements. The primary impact is confidentiality, enabling attackers to read sensitive files and access internal services. The attack requires prior authentication and the ADD permission, which somewhat limits the attack surface compared to unauthenticated SSRF vulnerabilities. Exploitation of this vulnerability is not currently documented as active in the wild. No exploitation activity has been reported in the Known Exploited Vulnerabilities (KEV) catalog, and the vulnerability remains on the inactive Hot List. The EPSS score of 0.00035 indicates very low predicted probability of exploitation, suggesting limited community attention or weaponization at this time. Organizations running vulnerable versions should nonetheless apply patches promptly, as the potential for sensitive data exfiltration remains significant for internal environments.