CVE-2026-35459

OVERVIEW CVE-2026-35459 is a server-side request forgery (SSRF) vulnerability in pyLoad, a free and open-source Python-based download manager. The vulnerability affects versions 0.5.0b3.dev96 and earlier. The flaw exists in the BaseDownloader.download() function, where IP validation checks only the initial download URL but fails to validate redirect targets. Since pycurl is configured with FOLLOWLOCATION=1 and MAXREDIRS=10, attackers can bypass SSRF protections by submitting URLs that redirect to internal addresses. SEVERITY This vulnerability carries a CRITICAL CVSS 3.1 score of 9.1 with a network-based attack vector requiring no user interaction and low attack complexity. The impact assessment indicates high confidentiality and integrity compromise potential, though availability is not affected. Exploitation requires only valid authentication with ADD permission, making it accessible to authenticated users within an organization rather than external actors. The EPSS score of 0.00037 suggests currently low real-world exploitation probability compared to other disclosed vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as CVE-2026-35459 is not listed on CISA's Known Exploited Vulnerabilities catalog and remains inactive on threat tracking lists. No public exploit code is currently documented. The moderate FAUCET risk score of 52.0/100 reflects the vulnerability's critical severity profile tempered by limited current exploitation activity and the authentication requirement.