by Kastro
Paper/Archive/CVE-2026-33992

CVE-2026-33992

pyload pyload — pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

EPSS 0.4%public exploitCVSS 9.3
critical.is priorityof 100
45
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 34.7.347 × 206.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive infrastructure data including droplet ID, network configuration, region, authentication keys, and SSH keys configured in user-data/cloud-init. Version 0.5.0b3.dev97 contains a patch.

Affected

ProductAffectedFixed inSource
pyload< 0.5.0b3.dev97–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/pyload/pyload/security/advisories/GHSA-m74m-f7cr-432xrefgithub.com/pyload/pyload/commit/b76b6d4ee5e32d2118d26afdee1d0a9e57d4bfe8