{"id":23080,"date":"2026-09-16T00:31:18","date_gmt":"2026-09-15T16:31:18","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-48737"},"modified":"2026-09-16T00:31:18","modified_gmt":"2026-09-15T16:31:18","slug":"cve-2026-48737","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-48737","title":{"rendered":"CVE-2026-48737 [MEDIUM] &#8211; pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev1"},"content":{"rendered":"<p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src\/pyload\/core\/utils\/web\/check.py relies on Python&#8217;s global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user can submit an IPv6 literal through parse_urls to the pre-resolution is_global_host guard. Because host_to_ip is pinned to AF_INET, that guard does not evaluate a hostname&#8217;s AAAA result. Separately, curl resolves hostnames before the pycurl PREREQFUNC in src\/pyload\/core\/network\/http\/http_request.py applies the same vulnerable is_global_address check to the actual connection address, so a transition-form AAAA result can be permitted even when it terminates at an embedded loopback, private, CGNAT, or link-local IPv4 address. Exploitation requires the pyLoad host to route the applicable transition mechanism, including 6to4 on affected Python 3.9 through 3.11 deployments or NAT64 on a network with a NAT64 gateway. Successful exploitation can enable internal-network reconnaissance, timing-based confirmation, limited service disruption, or cloud metadata disclosure where the wrapped address is routable. This issue is fixed in version 0.5.0b3.dev101.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src\/pyload\/core\/utils\/web\/check.py relies on Python&#8217;s global-address classification w<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-23080","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/23080","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=23080"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=23080"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=23080"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}