CVE-2026-35459 - Vulnerability Analysis
CriticalCVSS: 9.1Last Updated: April 7, 2026
pyLoad - Server-Side Request Forgery
Published: April 6, 2026Updated: April 7, 2026Remote Exploitable
Overview
pyLoad <= 0.5.0b3.dev96 contains a server-side request forgery caused by unvalidated HTTP redirects in BaseDownloader.download(), letting authenticated users with ADD permission bypass SSRF protections.
Severity & Score
Severity: Critical
CVSS Score: 9.1
Impact
Authenticated attackers can bypass SSRF protections to make the server send requests to internal addresses, potentially accessing internal resources.
Mitigation
Update to a version that properly validates redirect targets or the latest available version.
References
Related Resources
Details
- CVE ID
- CVE-2026-35459
- Severity
- Critical
- CVSS Score
- 9.1
- Type
- server_side_request_forgery
- Status
- unconfirmed
CWE
- CWE-918
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N