A Server‑Side Request Forgery flaw was found in pyLoad’s parse_urls API, allowing an authenticated attacker to supply a URL that redirects to a private or internal IP address. The redirect bypasses the intended global‑host check, letting the attacker trigger requests to internal resources that should otherwise be blocked. The core weakness is a missing private‑IP guard on HTTP redirects, which can be abused for internal network enumeration or to reach services behind a firewall.

The vulnerability affects the pyLoad download manager developed by pyload:pyload. Any installation running a version older than 0.5.0b3.dev100 is susceptible, as the private‑IP check was not applied to HTTPRequest used by parse_urls.; earlier releases such as 0.4.x or 0.5.0b2 are included in this risk group.

The CVSS score is 5, indicating moderate risk. No EPSS score is available, so the likelihood of exploitation cannot be quantified precisely, but the flaw is listed as not part of CISA’s KEV catalog. Because the API requires authentication, an attacker must first obtain valid credentials; however, once authenticated, the attacker can perform remote internal requests and gain unauthorised access to internal services or data. The attack vector is inferred to be internal network access after redirect, posing potential confidentiality and availability risks to the victim’s internal infrastructure.