pyLoad includes a SSRF flaw that allows a logged‑in user with ADD permissions to submit a download URL that redirects to an internal host. The download routine performs hostname validation on the initial URL only; however, pycurl is configured to follow HTTP redirects automatically, and the redirects are not re‑validated. An attacker can exploit this to trigger the server to access private IP addresses, exfiltrate data, or use the server as a pivot point into the internal network.

The vulnerability exists in pyLoad 0.5.0b3.dev96 and all earlier releases. End‑users of these versions should be aware that the SSRF exploit is present unless a newer release that includes the fix is installed.

With a CVSS score of 9.3, this flaw represents a high‑severity risk. The exploit requires authenticated access with ADD privilege, but the easy availability of such accounts in typical installations increases the likelihood of exploitation. Although EPSS data is not available and the issue is not yet listed in the CISA KEV catalog, the potential for internal impact warrants immediate attention.