CVE-2026-48737

Name of the Vulnerable Software and Affected Versions pyload-ng (affected versions not specified)

Description An issue exists where the software is susceptible to Server-Side Request Forgery (SSRF). The is global address() and is global host() functions in src/pyload/core/utils/web/check.py rely on Python's ipaddress.ip address(value).is global to block private connections. However, this method incorrectly classifies NAT64 and 6to4 IPv6 transition prefixes as globally routable, even when they wrap internal IPv4 addresses such as loopback, RFC 1918, or cloud metadata services (IMDS). An attacker can use these IPv6 literals or hostnames with corresponding AAAA records to bypass the security check and force the application to connect to internal endpoints. This is particularly effective on networks with NAT64 gateways or 6to4 routing configured.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.