Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-48737— pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

Quick assessment

Affected
pyload pyload
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pyLoad 是一个用 Python 编写的免费且开源的下载管理器。在 0.5.0b3.dev101 之前， 中的 函数直接依赖 Python 的全局地址分类机制，却未检查嵌入在 6to4 或 NAT64 IPv6 地址中的 IPv4 目标地址。低权限用户可以通过 提交一个 IPv6 字面量，绕过解析前的 防护机制。由于 被固定为 （即仅解析 IPv4 A 记录），该防护机制不会评估主机名的 AAAA 解析结果。 此外，curl 会在应用同一存在漏洞的 检查（位于 的 pycurl 中）之前解析主机名，并将检查应用

CVSS 4.9 · Medium

Possible ATT&CK Techniques 2 AI

T1515 T1046 · Network Service Discovery
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-48737

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs
Source: CVE Program / CVE List V5
Vulnerability Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user can submit an IPv6 literal through parse_urls to the pre-resolution is_global_host guard. Because host_to_ip is pinned to AF_INET, that guard does not evaluate a hostname's AAAA result. Separately, curl resolves hostnames before the pycurl PREREQFUNC in src/pyload/core/network/http/http_request.py applies the same vulnerable is_global_address check to the actual connection address, so a transition-form AAAA result can be permitted even when it terminates at an embedded loopback, private, CGNAT, or link-local IPv4 address. Exploitation requires the pyLoad host to route the applicable transition mechanism, including 6to4 on affected Python 3.9 through 3.11 deployments or NAT64 on a network with a NAT64 gateway. Successful exploitation can enable internal-network reconnaissance, timing-based confirmation, limited service disruption, or cloud metadata disclosure where the wrapped address is routable. This issue is fixed in version 0.5.0b3.dev101.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pyload pyload < 0.5.0b3.dev101 -

II. Public POCs for CVE-2026-48737

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-48737

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-48737 (1)

Vendor Advisories for CVE-2026-48737 (1)

IV. Related Vulnerabilities

Same product: pyload
Same vendor: pyload
Same weakness: CWE-918

V. Comments for CVE-2026-48737

No comments yet

Leave a comment