External risk intelligence

pyLoad SSRF Vulnerability Due to Insecure Redirect Handling

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-35459

pyLoad is a network-accessible download manager typically deployed as a web-based application. While it often operates behind a firewall or in a home environment, its primary function involves web-based interaction and it is commonly accessible via a web interface, making it a likely target for remote interaction in many standard deployment scenarios.

Server-Side Request Forgery

Pyload Ng Project Pyload Ng

before 0.5.0b3.dev97

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recent vulnerability has been identified in the pyLoad download manager that could allow an authenticated user to bypass existing security measures. This issue stems from how the software handles redirects, potentially enabling access to internal network resources.

Bypasses security for internal network access.
Matters for any organization using this download tool.
Assess relevance to confirm internal exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by initiating a download with a carefully crafted URL. This URL would be designed to redirect to an internal resource, bypassing security checks that were intended to prevent Server-Side Request Forgery. If successful, this could allow the attacker to interact with internal systems.

Authenticated user with ADD permission required.
Redirected URL triggers vulnerability.
Potential for internal system access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated user to bypass security checks and access internal network resources. This is possible when pyLoad is configured to follow HTTP redirects, and a malicious URL is provided that redirects to an unauthorized internal address.

Internal network access to services.
Malicious URL with redirects.
Unauthorized access to internal resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of pyLoad typically falls to the application owner or the platform team managing the Python environment where it's deployed. The initial step is to identify all pyLoad instances, determine their reachability and criticality, and locate the accountable owner. This information is crucial for planning remediation activities, which may involve vendor coordination if the affected component is managed externally, or scheduling maintenance windows for patching.

Identify pyLoad instances and ownership.
Verify instance reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is pyLoad?

pyLoad is an open-source, Python-based download manager designed to handle automated downloads from various web services. It provides a web-based interface that allows users to manage, queue, and execute file transfers remotely, making it a common tool for centralizing download tasks across different environments.

How does CVE-2026-35459 relate to Server-Side Request Forgery?

This vulnerability is a Server-Side Request Forgery (SSRF) flaw, classified under CWE-918. It happens because the application's URL validation logic only checks the initial link provided. Since the software is configured to automatically follow HTTP redirects, it blindly visits whatever address the initial link points to, ignoring the security filter and potentially reaching internal systems.

Do I need special access to trigger this SSRF bug?

Yes, an attacker must have an account on the pyLoad instance with 'ADD' permissions to initiate a download request. Simple, unauthenticated network traffic to the service will not trigger this vulnerability. The flaw is specifically tied to the processing of malicious URLs submitted by an authenticated user.

Why does Halo Surface Signal categorize this as a likely target?

Halo Surface Signal notes that pyLoad is a network-accessible web application by design. Because its core function involves interacting with the web, these instances are frequently exposed or accessible via web interfaces, increasing the likelihood that they could be reached and manipulated by remote actors.

How should I respond to this vulnerability in my environment?

Begin by creating an inventory of all pyLoad deployments to establish which systems are running the affected versions. Coordinate with the platform teams responsible for these environments to determine their reachability and business impact. Prioritize these instances for updates or security configuration changes to prevent unauthorized internal network access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.