The vulnerability resides in pyLoad’s parse_urls API endpoint, where the supplied URL is forwarded server‑side without validation. An authenticated user with ADD permission may request arbitrary URLs, including internal network addresses, file://, gopher://, and dict:// protocols. This enables reading local files, communicating with internal services, and enumerating file existence through error responses. The weakness is a classic Server Side Request Forgery (CWE‑918) that can lead to internal data exposure or network reconnaissance.

The affected product is pyLoad (pyload:pyload). Versions up to and including 0.5.0b3.dev96 are vulnerable; later releases contain mitigations.

With a CVSS base score of 7.7 the vulnerability is considered high severity. While EPSS data is unavailable and it is not listed in KEV, exploitation requires authenticated access to pyLoad, limiting the attack surface. Nonetheless, an attacker could leverage the SSRF to access internal services, metadata endpoints, or download sensitive files if permissions are granted.