VulnSocial

CVE-2026-35187Disclosure(pyload-ng_project / pyload-ng)

LOWCVSS 7.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints, read local files via file:// protocol (pycurl reads the file server-side), interact with internal services via gopher:// and dict:// protocols, and enumerate file existence via error-based oracle (error 37 vs empty response).

pyload-ng_project CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pyload-ng

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
pyload-ng_project
Products
pyload-ng

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-04-06: 204-06
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-35187 pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetc… https://www.cve.org/CVERecord?id=CVE-2026-35187 ----- Traducción: CVE-2026-35187 pyL… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-35187 affecting pyLoad, noting affected versions, but offers no exploit evidence, remediation, or detailed technical data.

    0000032
    67 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-35187 pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetc… https://www.cve.org/CVERecord?id=CVE-2026-35187

    Post summary

    The message references CVE‑2026‑35187 as affecting the parse_urls API function in pyLoad, but provides no evidence of exploitation, remediation, or detailed technical characteristics.

    00000154
    57.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apppyload-ng_projectpyload-ng-python-

Explore more

Back to dashboardpyload-ng_project CVEspyload-ng vulnerabilities