CVE-2026-35187 pyload CVE debrief

Who should care

Users of pyLoad version 0.5.0b3.dev96 and earlier should apply patches or mitigations to prevent exploitation of this vulnerability. Organizations using pyLoad in their infrastructure should prioritize patching, as an authenticated user with ADD permission can exploit this vulnerability to access internal network resources and cloud metadata endpoints.

Technical summary

The parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. This allows an authenticated user with ADD permission to make requests to internal network resources and cloud metadata endpoints, read local files, interact with internal services, and enumerate file existence.

Defensive priority

High

Recommended defensive actions

• Apply patches or mitigations provided by the vendor
• Restrict access to the parse_urls API function
• Implement URL validation and protocol restriction
• Monitor for suspicious activity
• Inventory and audit pyLoad installations

Evidence notes

The vulnerability is confirmed to exist in pyLoad version 0.5.0b3.dev96 and earlier. The vendor has provided patches and mitigations for the vulnerability. Evidence is limited to public sources and vendor advisories, which indicate that an authenticated user with ADD permission can exploit this vulnerability. Defenders should verify the existence of affected pyLoad deployments, review official advisories, and plan for vendor-supported updates or mitigations. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked, and exceptions should be tracked and retested.

Official resources