CVE-2026-48737

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, isglobaladdress in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user...

CVE-2026-48737 pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, isglobaladdress in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user...

CVE-2026-48737

pyLoad (pyload-ng), a Python-based open-source download manager, has an SSRF guard bypass (CWE-918) in its is_global_address function. The guard relies on Python's ipaddress.IPv6Address.is_global, which classifies 6to4 (2002::/16) and NAT64 (64:ff9b::/96) transition prefixes as globally routable ...

CVE-2026-48737 pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, isglobaladdress in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user...

CVE-2026-48737 pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, isglobaladdress in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user...

CVE-2026-48737: Server-Side Request Forgery (SSRF)

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, isglobaladdress in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user...