CVE-2026-123814

MediumCVSS 6.4/10Last modified Nov 10, 2026

Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/save_config by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in src/pyload/plugins/addons/WindowsPhoneNotify.py then uses http.client.HTTPConnection without pyLoad's pycurl destination validation. When a download completes, the global notification event causes a blind POST from the pyLoad server to the attacker-selected internal host, port, and path. The response is not returned, but the request can probe internal services, reach cloud metadata endpoints, or trigger state-changing internal HTTP endpoints. This issue is fixed in version 0.5.0b3.dev102.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1238168.1pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.check_apikey caches successful validation CVE-2026-123828.2A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP head CVE-2026-1238205.3Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Ima CVE-2026-1238246.3The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external CVE-2026-1238285.9A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an a CVE-2026-1238292.5A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to re CVE-2026-123837.5A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classe CVE-2026-1238319.6In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings CVE-2026-1238329.6In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database CVE-2026-1238333.6In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects CVE-2026-1238347.5In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account CVE-2026-1238355.9In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition