CVE-2026-46561
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedpyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the PREREQFUNCTION-based private IP check was not applied to HTTPRequest (used by the parse_urls API). An authenticated attacker can supply a URL pointing to an attacker-controlled server that responds with a 302 redirect to an internal/private IP address, bypassing the is_global_host() check on the initial URL. This vulnerability is fixed in 0.5.0b3.dev100.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidencepyLoad prior to 0.5.0b3.dev100 had a vulnerability where the PREREQFUNCTION-based private IP check was not applied to HTTPRequest (used by parse_urls API). An authenticated attacker could supply a URL to an attacker-controlled server that returns a 302 redirect to an internal/private IP address, bypassing the is_global_host() check that only validated the initial URL.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify pyLoad installationRun 'pip show pyload' or check the pyLoad installation directory for version informationAffected if pyLoad is not installed or version cannot be determined
-
Compare installed version to affected rangeCheck if the installed version is prior to 0.5.0b3.dev100 by examining the version string from step 1Affected if Installed version is 0.5.0b3.dev99 or earlier, or any version prior to 0.5.0b3.dev100
-
Verify parse_urls API accessibilityCheck if the pyLoad web interface or API endpoint for parse_urls is exposed and accessible to authenticated usersAffected if The parse_urls API endpoint is accessible without additional network segmentation
-
Inspect HTTPRequest source code for IP validationExamine the pyLoad source code (specifically HTTPRequest class and parse_urls implementation) to see if is_global_host() or equivalent private IP check is applied to HTTPRequest and redirect handlingAffected if The source code shows HTTPRequest/parse_urls does not validate redirected URLs against private IP ranges (is_global_host check missing for redirects)
A user is affected if pyLoad version is 0.5.0b3.dev99 or earlier and the parse_urls API is accessible to authenticated users without the private IP validation fix applied to redirect handling.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade pyLoad to version 0.5.0b3.dev100 or later, which applies the private IP check to HTTPRequest/parse_urls API.
0.5.0b3.dev100
- Upgrade pyLoad to version 0.5.0b3.dev100 or later
- Verify the upgrade was successful by checking the installed version
- Confirm that the parse_urls API now properly applies the private IP check to redirected URLs, preventing SSRF via 302 redirects to internal/private addresses
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation6.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,984.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-46561 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-46561 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data