pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.4 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary pyLoad ships the WindowsPhoneNotify addon, whose `send()` method opens an HTTP connection to a host taken directly from the plugin's `pushurl` configuration value. A user holding the standard non-admin `SETTINGS` permission can set `pushurl` and `pushid` and enable the addon through the web API, since these plugin options are not in the admin-only option set. Once enabled, the addon activates dynamically without a restart, and any completed download (download events fire globally, not per user) causes the addon to send an HTTP POST to the configured host and path. The request is made with Python's `http.client.HTTPConnection`, so it never passes through pyLoad's pycurl-based outbound connection guard. The attacker can therefore direct blind POST requests at internal hosts such as loopback services, RFC 1918 addresses, or the cloud metadata endpoint `169.254.169.254`.

Root Cause pyLoad enforces its outbound SSRF protection only inside the pycurl request path, where a…

Published by the source

9 Oct 2026, 17:09 UTC

Last modified by the source

26 Oct 2026, 16:01 UTC

Source last checked

27 Oct 2026, 06:15 UTC

1. Revision 3 · amended · 27 Oct 2026

   Amended from osv record GHSA-p3pr-8f3m-4qp8

2. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-p3pr-8f3m-4qp8

3. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-p3pr-8f3m-4qp8

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-p3pr-8f3m-4qp8

Advisory: pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
IDs: GHSA-p3pr-8f3m-4qp8
Record: https://patchnext.com/advisories/ghsa-p3pr-8f3m-4qp8 (revision 3, source checked 27 Oct 2026, 06:15 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.4)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor response not established. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI pyload-ng: affected <= 0.5.0b3.dev101

## Suggested inspection (read-only)
- `python -m pip show pyload-ng`: prints the installed version. Run with the environment that serves production active.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on pyload-ng.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-p3pr-8f3m-4qp8 (GitHub-reviewed advisory GHSA-p3pr-8f3m-4qp8 lists affected ranges: PyPI pyload-ng >=0 <=0.5.0b3.dev101)
- Verified: https://osv.dev/vulnerability/GHSA-p3pr-8f3m-4qp8 (OSV record GHSA-p3pr-8f3m-4qp8 lists affected ranges: PyPI pyload-ng >=0 <=0.5.0b3.dev101)

Commands are suggestions: review each one before running it.