CVE-2026-33992
Server-Side Request Forgery in pyLoad Download Engine Exposes Metadata
Publication date: 2026-03-27
Last updated on: 2026-03-31
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pyload | pyload | 0.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in pyLoad, a Python-based download manager. Before version 0.5.0b3.dev97, pyLoad's download engine would accept arbitrary URLs without validating them. This flaw allows an authenticated attacker to perform Server-Side Request Forgery (SSRF) attacks.
By exploiting this, the attacker can access internal network services and extract sensitive metadata from cloud providers.
For example, on DigitalOcean droplets, this could expose critical infrastructure information such as droplet ID, network configuration, region, authentication keys, and SSH keys configured via user-data or cloud-init.
The vulnerability was fixed in version 0.5.0b3.dev97.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to internal network services and leakage of sensitive infrastructure data.
- Exposure of cloud provider metadata such as droplet ID, network configuration, and region.
- Disclosure of authentication keys and SSH keys configured in user-data or cloud-init.
Such exposure can lead to further compromise of the affected systems and infrastructure.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade pyLoad to version 0.5.0b3.dev97 or later, which contains a patch that validates URLs to prevent Server-Side Request Forgery (SSRF) attacks.
Additionally, restrict access to the pyLoad application to trusted users only, as exploitation requires authentication.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in pyLoad allows an authenticated attacker to perform Server-Side Request Forgery (SSRF) attacks, potentially accessing internal network services and exfiltrating sensitive cloud provider metadata, including authentication keys and SSH keys.
This exposure of sensitive infrastructure data could lead to unauthorized access to personal or protected information, which may impact compliance with standards and regulations such as GDPR and HIPAA that require protection of sensitive data and secure access controls.
However, the provided information does not explicitly discuss the direct impact on compliance with these regulations.