Server-side Request Forgery (SSRF) Affecting pyload-ng package, versions [0,]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-PYLOADNG-21693778
- published24 Oct 2026
- disclosed9 Oct 2026
- creditDaniel Coles
Introduced: 9 Oct 2026
New CVE NOT AVAILABLE CWE-918 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
pyload-ng is a The free and open-source Download Manager written in pure Python
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the AndroidPhoneNotify and WindowsPhoneNotify notification plugins, which issue outbound HTTP requests to URLs derived from user-supplied configuration values without validation. An authenticated attacker can supply an arbitrary URL as the API endpoint or push URL, causing the server to make requests to internal or external hosts of the attacker's choosing.