PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35187 pyload CVE debrief

CVE-2026-35187 is a server-side request forgery vulnerability in pyLoad, a free and open-source download manager written in Python. The vulnerability exists in the parse_urls API function in src/pyload/core/api/__init__.py, which fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints, read local files via file:// protocol (pycurl reads the file server-side), interact with internal services via gopher:// and dict:// protocols, and enumerate file existence via error-based oracle (error 37 vs empty response).

Vendor
pyload
Product
Unknown
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Users of pyLoad version 0.5.0b3.dev96 and earlier should apply patches or mitigations to prevent exploitation of this vulnerability. Organizations using pyLoad in their infrastructure should prioritize patching, as an authenticated user with ADD permission can exploit this vulnerability to access internal network resources and cloud metadata endpoints.

Technical summary

The parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. This allows an authenticated user with ADD permission to make requests to internal network resources and cloud metadata endpoints, read local files, interact with internal services, and enumerate file existence.

Defensive priority

High

Recommended defensive actions

  • Apply patches or mitigations provided by the vendor
  • Restrict access to the parse_urls API function
  • Implement URL validation and protocol restriction
  • Monitor for suspicious activity
  • Inventory and audit pyLoad installations

Evidence notes

The vulnerability is confirmed to exist in pyLoad version 0.5.0b3.dev96 and earlier. The vendor has provided patches and mitigations for the vulnerability. Evidence is limited to public sources and vendor advisories, which indicate that an authenticated user with ADD permission can exploit this vulnerability. Defenders should verify the existence of affected pyLoad deployments, review official advisories, and plan for vendor-supported updates or mitigations. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked, and exceptions should be tracked and retested.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35187 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35187

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35187 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35187

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.