{"affected":[{"product":"pyload","source":"CNA: GitHub_M","vendor":"pyload","versions":[{"status":"affected","version":"< 0.5.0b3.dev102"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"pyload-ng","product":"pyload-ng","source":"OSV GHSA-p3pr-8f3m-4qp8","vendor":"","versions":[{"status":"affected","version":"0.5.0a5.dev528","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev532","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev535","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev536","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev537","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev539","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev540","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev545","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev562","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev564","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev565","versionType":"PyPI"},{"status":"affected","version":"0.5.0a6.dev570","versionType":"PyPI"},{"status":"affected","version":"0.5.0a6.dev578","versionType":"PyPI"},{"status":"affected","version":"0.5.0a6.dev587","versionType":"PyPI"},{"status":"affected","version":"0.5.0a7.dev596","versionType":"PyPI"},{"status":"affected","version":"0.5.0a8.dev602","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev615","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev629","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev632","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev641","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev643","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev655","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev806","versionType":"PyPI"},{"status":"affected","version":"0.5.0b1.dev1","versionType":"PyPI"},{"status":"affected","version":"0.5.0b1.dev2","versionType":"PyPI"},{"status":"affected","version":"0.5.0b1.dev3","versionType":"PyPI"},{"status":"affected","version":"0.5.0b1.dev4","versionType":"PyPI"},{"status":"affected","version":"0.5.0b1.dev5","versionType":"PyPI"},{"status":"affected","version":"0.5.0b2.dev10","versionType":"PyPI"},{"status":"affected","version":"0.5.0b2.dev11","versionType":"PyPI"},{"status":"affected","version":"0.5.0b2.dev12","versionType":"PyPI"},{"status":"affected","version":"0.5.0b2.dev9","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev100","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev101","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev13","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev14","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev17","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev18","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev19","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev20","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev21","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev22","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev24","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev26","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev27","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev28","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev29","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev30","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev31","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev32","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev33","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev34","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev35","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev38","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev39","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev40","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev41","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev42","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev43","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev44","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev45","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev46","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev47","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev48","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev49","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev50","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev51","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev52","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev53","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev54","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev57","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev60","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev62","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev64","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev65","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev66","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev67","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev68","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev69","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev70","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev71","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev72","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev73","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev74","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev75","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev76","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev77","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev78","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev79","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev80","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev81","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev82","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev85","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev87","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev88","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev89","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev90","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev91","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev92","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev93","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev94","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev95","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev96","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev97","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev98","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev99","versionType":"PyPI"},{"events":[{"introduced":"0"},{"last_affected":"0.5.0b3.dev101"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-123814","cwes":["CWE-918"],"description":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/save_config by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in src/pyload/plugins/addons/WindowsPhoneNotify.py then uses http.client.HTTPConnection without pyLoad's pycurl destination validation. When a download completes, the global notification event causes a blind POST from the pyLoad server to the attacker-selected internal host, port, and path. The response is not returned, but the request can probe internal services, reach cloud metadata endpoints, or trigger state-changing internal HTTP endpoints. This issue is fixed in version 0.5.0b3.dev102.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.4,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},{"score":6.4,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794262717903,"publishedAt":1794258546290,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/pyload/pyload/security/advisories/GHSA-p3pr-8f3m-4qp8"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/pyload/pyload/commit/989a551d2ae0c00b0d2c7baf6d850180c9b46559"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/pyload/pyload/commit/989a551d2ae0c00b0d2c7baf6d850180c9b46559"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/pyload/pyload/security/advisories/GHSA-p3pr-8f3m-4qp8"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-p3pr-8f3m-4qp8"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-p3pr-8f3m-4qp8"}],"remediation":[],"revision":"06463ac45936d3c2e2c416a3f90e8312705a2e15e464badf5eabc77e905ac503","sources":[{"modifiedAt":1794258546290,"name":"CNA: GitHub_M","retrievedAt":1794262157342,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123814"},{"modifiedAt":1794262717903,"name":"NVD","retrievedAt":1794269999414,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123814"},{"modifiedAt":1794258904227,"name":"OSV / GitHub Security Advisories","retrievedAt":1794262158019,"url":"https://osv.dev/vulnerability/GHSA-p3pr-8f3m-4qp8"}],"ssvc":null,"status":"published","title":"pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host","updatedAt":1794269999414}