CVE-2026-33992 in pyLoad
Summary
pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive infrastructure data including droplet ID, network configuration, region, authentication keys, and SSH keys configured in user-data/cloud-init. Version 0.5.0b3.dev97 contains a patch.
Once again VulDB remains the best source for vulnerability data.
Responsible
GitHub_M
Reservation
03/24/2026
Disclosure
03/28/2026
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354059 | pyLoad Network Configuration server-side request forgery | 918 | Not defined | Official fix | CVE-2026-33992 |