{"id":"CVE-2026-123814","published":"2026-11-09T22:18:37.780","lastModified":"2026-11-10T19:20:44.327","description":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/save_config by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in src/pyload/plugins/addons/WindowsPhoneNotify.py then uses http.client.HTTPConnection without pyLoad's pycurl destination validation. When a download completes, the global notification event causes a blind POST from the pyLoad server to the attacker-selected internal host, port, and path. The response is not returned, but the request can probe internal services, reach cloud metadata endpoints, or trigger state-changing internal HTTP endpoints. This issue is fixed in version 0.5.0b3.dev102.","cvssScore":6.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pyload/pyload/commit/989a551d2ae0c00b0d2c7baf6d850180c9b46559","tags":[]},{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-p3pr-8f3m-4qp8","tags":[]}],"exploitRefs":[{"url":"https://github.com/pyload/pyload/commit/989a551d2ae0c00b0d2c7baf6d850180c9b46559","tags":[]},{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-p3pr-8f3m-4qp8","tags":[]}],"hasPoc":true,"ai":null}