Vulnerability in pyLoad Download Manager Allows Unauthorized Internal Requests
CVE-2026-123814

6.4MEDIUM

Key Information:

Vendor

Pyload

Status
Pyload
Vendor
CVE Published:
9 November 2026

What is CVE-2026-123814?

The pyLoad download manager, an open-source solution implemented in Python, is susceptible to an issue where an authenticated user lacking administrative privileges can exploit the SETTINGS permission. Through the /json/save_config endpoint, these individuals can manipulate the WindowsPhoneNotify plugin by configuring various parameters. This vulnerability allows the execution of a blind POST request to an internal server of their choice when a download is completed. Consequently, this can lead to exposure of internal services, communication with cloud metadata, or triggering internal HTTP requests that may alter the state of the services.

Affected Version(s)

pyload < 0.5.0b3.dev102

References

https://github.com/pyload/pyload/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/pyload/pyload/commit/989a551d2ae0c00b0...
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.