9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35459

CVE-2026-35459: pyLoad has SSRF fix bypass via HTTP redirect

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-2026-33992 added IP validation to BaseDownloader.download() that checks the hostname of the initial download URL. However, pycurl is configured with FOLLOWLOCATION=1 and MAXREDIRS=10, causing it to automatically follow HTTP redirects. Redirect targets are never validated against the SSRF filter. An authenticated user with ADD permission can bypass the SSRF fix by submitting a URL that redirects to an internal address.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35459

CVE-2026-35459:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pyload-ng	pip	<= 0.5.0b3.dev96

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) bypass in pyLoad's download functionality. It exists because of an incomplete fix for a previous vulnerability (CVE-2026-33992).

The root cause is a combination of two factors:

An insufficient SSRF check in the BaseDownloader.download function, which only validates the IP address of the initial download URL.
The configuration of the underlying pycurl library in HTTPRequest.init_handle to automatically follow HTTP redirects (FOLLOWLOCATION=1).

An authenticated attacker with 'ADD' permissions can exploit this by providing a URL that points to a server under their control. This initial URL will pass the SSRF check if it resolves to a public IP address. The attacker's server then issues an HTTP redirect (e.g., 302) to a restricted internal address, such as a cloud metadata endpoint (169.254.169.254) or an internal service. Because pycurl is configured to follow redirects automatically, it will then make a request to the internal address, bypassing the security check entirely.

The identified vulnerable functions are BaseDownloader.download, which contains the flawed validation logic, and HTTPRequest.init_handle, which enables the insecure redirect following. During exploitation, a runtime profile would show calls to BaseDownloader.download followed by the internal workings of the HTTPRequest class as it processes the download and the subsequent malicious redirect.

Vulnerable functions

BaseDownloader.download

src/pyload/plugins/base/downloader.py

This function is the entry point for downloads and contains an insufficient SSRF check. It validates the hostname of the initial URL provided by the user, but it does not account for HTTP redirects. An attacker can provide a URL that passes this initial check but then redirects to a restricted internal or cloud metadata IP address, bypassing the intended security control.

HTTPRequest.init_handle

src/pyload/core/network/http/http_request.py

This function configures the `pycurl` instance to automatically follow HTTP redirects by setting `FOLLOWLOCATION` to 1. This behavior is the root cause of the SSRF bypass, as it allows an attacker-controlled server to redirect the download process to an arbitrary URL without any further validation. The fix for this vulnerability involves either disabling automatic redirects or implementing a callback function (`PREREQFUNCTION`) to validate the IP address of each redirect target.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.