Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user can submit an IPv6 literal through parse_urls to the pre-resolution is_global_host guard. Because host_to_ip is pinned to AF_INET, that guard does not evaluate a hostname's AAAA result. Separately, curl resolves hostnames before the pycurl PREREQFUNC in src/pyload/core/network/http/http_request.py applies the same vulnerable is_global_address check to the actual connection address, so a transition-form AAAA result can be permitted even when it terminates at an embedded loopback, private, CGNAT, or link-local IPv4 address. Exploitation requires the pyLoad host to route the applicable transition mechanism, including 6to4 on affected Python 3.9 through 3.11 deployments or NAT64 on a network with a NAT64 gateway. Successful exploitation can enable internal-network reconnaissance, timing-based confirmation, limited service disruption, or cloud metadata disclosure where the wrapped address is routable. This issue is fixed in version 0.5.0b3.dev101.
Published: 2026-09-15
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Server Side Request Forgery (SSRF)
Action: Patching
AI Analysis

Impact

The vulnerability is a boundary‑checking flaw in pyLoad’s SSRF guard that allows a low‑privileged user to supply an IPv6 literal containing a 6to4 or NAT64 transition wrapper. The guard relies on Python’s global‑address classification without inspecting the embedded IPv4 destination, so the fake IPv6 address can resolve to a loopback, private, CGNAT, or link‑local IPv4 address. Successful exploitation permits internal‑network reconnaissance, timing‑based confirmation, limited service disruption, or cloud metadata disclosure when the wrapped address is routable to internal resources.

Affected Systems

The flaw affects the pyLoad download manager on versions prior to 0.5.0b3.dev101, running with Python 3.9 through 3.11, and when the host participates in 6to4 or NAT64 transition routing.

Risk and Exploitability

With a CVSS score of 4.9 the vulnerability is a medium severity issue; its EPSS score is not available and it is not listed in KEV. The vulnerability can be exploited through crafted URL input or curl requests that trigger the vulnerable guard; it requires the pyLoad host to route 6to4 or NAT64 traffic, but does not need elevated privileges.

Generated by OpenCVE AI on September 16, 2026 at 04:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install pyLoad version 0.5.0b3.dev101 or later to apply the fix for the SSRF guard bypass.
  • Block 6to4/NAT64 traffic to the pyLoad host using firewall rules so that transition addresses’ outbound connections are limited to trusted IP ranges.
  • Disable IPv6 transition mechanisms in pyLoad’s configuration to prevent the SSRF guard from being tricked by wrapped addresses.

Generated by OpenCVE AI on September 16, 2026 at 04:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-m5x5-28jr-gpjj pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs
History

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Pyload
Pyload pyload
Vendors & Products Pyload
Pyload pyload

Tue, 15 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user can submit an IPv6 literal through parse_urls to the pre-resolution is_global_host guard. Because host_to_ip is pinned to AF_INET, that guard does not evaluate a hostname's AAAA result. Separately, curl resolves hostnames before the pycurl PREREQFUNC in src/pyload/core/network/http/http_request.py applies the same vulnerable is_global_address check to the actual connection address, so a transition-form AAAA result can be permitted even when it terminates at an embedded loopback, private, CGNAT, or link-local IPv4 address. Exploitation requires the pyLoad host to route the applicable transition mechanism, including 6to4 on affected Python 3.9 through 3.11 deployments or NAT64 on a network with a NAT64 gateway. Successful exploitation can enable internal-network reconnaissance, timing-based confirmation, limited service disruption, or cloud metadata disclosure where the wrapped address is routable. This issue is fixed in version 0.5.0b3.dev101.
Title pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L'}

Subscriptions

Pyload Pyload
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-16T16:04:53.088Z

Reserved: 2026-05-22T19:10:35.746Z

Link: CVE-2026-48737

cve-icon Vulnrichment

Updated: 2026-09-16T16:04:25.729Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T15:17:16.220

Modified: 2026-09-16T17:17:18.907

Link: CVE-2026-48737

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T04:30:11Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)