pyLoad’s download engine accepted arbitrary URLs without validation before version 0.5.0b3.dev97, allowing a Server‑Side Request Forgery vulnerability. An attacker who could authenticate to the application could make the server request any internal or external resource, enabling access to sensitive internal network services and leakage of cloud metadata such as droplet identifiers, network settings, region, and SSH keys. This constitutes a severe breach of confidentiality and potential compromise of the infrastructure.

pyLoad download manager as distributed in releases prior to 0.5.0b3.dev97, including version 0.5.0. The vulnerability applies to all installations that use the default download engine without URL validation. The affected product is the pyLoad pyload bundle as identified by the CPE cpe:2.3:a:pyload:pyload:0.5.0.

With a CVSS base score of 9.3 the score reflects high impact and exploitation ease. The EPSS score is below 1 % indicating a low probability of widespread exploitation, and the vulnerability is not yet in CISA’s KEV list. The attack vector requires an authenticated user’s session, which is inferred from the description. Once authenticated, the attacker can trigger SSRF via the download link submission interface, causing the server to perform outbound requests and retrieve cloud metadata.