CVE-2026-123814— pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

Quick assessment

Affected

pyload pyload

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pyLoad 是一款用 Python 编写的免费开源下载管理器。在 0.5.0b3.dev102 版本之前，拥有 SETTINGS 权限的已认证非管理员用户可通过接口配置 WindowsPhoneNotify 插件，设置、和参数。随后，位于中的方法会使用发起请求，但未经过 pyLoad 的 pycurl 目标地址验证机制。当下载任务完成时，全局通知事件会触发 pyLoad 服务器向攻击者指定的内部主机、端口及路径发起盲发 POST 请求。该请求不会返回响应内容，但可用于探测内部服务、访问云元数据端点，

CVSS 6.4 · Medium Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1046 · Network Service Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

Source: CVE Program / CVE List V5

Vulnerability Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/save_config by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in src/pyload/plugins/addons/WindowsPhoneNotify.py then uses http.client.HTTPConnection without pyLoad's pycurl destination validation. When a download completes, the global notification event causes a blind POST from the pyLoad server to the attacker-selected internal host, port, and path. The response is not returned, but the request can probe internal services, reach cloud metadata endpoints, or trigger state-changing internal HTTP endpoints. This issue is fixed in version 0.5.0b3.dev102.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pyload	pyload	< 0.5.0b3.dev102	-

II. Public POCs for CVE-2026-123814

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123814

请登录查看更多情报信息。

Other References for CVE-2026-123814 (2)

https://github.com/pyload/pyload/security/advisories/GHSA-p3pr-8f3m-4qp8 x_refsource_CONFIRM
https://github.com/pyload/pyload/commit/989a551d2ae0c00b0d2c7baf6d850180c9b46559 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-123814

Same Patch Batch · pyload · 2026-11-09 · 4 CVEs total

CVE-2026-123815	9.4 CRITICAL	pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile
CVE-2026-123816	8.1 HIGH	pyLoad: Authentication bypass in API key validation (check_apikey cache)
CVE-2026-123813	7.5 HIGH	pyLoad: Privilege revocation and password change through the REST API do not invalidate th

IV. Related Vulnerabilities

Same product: pyload

Same vendor: pyload

Same weakness: CWE-918