CVE-2026-123814

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev102

Description An authenticated non-admin user with the SETTINGS permission can perform a Server-Side Request Forgery (SSRF) attack. By accessing the /json/save config endpoint, an attacker can configure the WindowsPhoneNotify addon by setting the pushurl, pushid, and enabled variables. The WindowsPhoneNotify.send() function in src/pyload/plugins/addons/WindowsPhoneNotify.py utilizes http.client.HTTPConnection, which bypasses the application's standard destination validation. When a download completes, the server sends a blind HTTP POST request to the attacker-specified internal host, port, and path. This can be used to probe internal services, access cloud metadata endpoints (such as 169.254.169.254), or trigger state-changing internal HTTP endpoints.

Recommendations Update to version 0.5.0b3.dev102. As a temporary mitigation, restrict the SETTINGS permission to trusted accounts only. Restrict the network access of the pyLoad host to prevent it from reaching sensitive internal endpoints.