{"items":[{"id":"NVI-00010574","kind":"vulnerability","title":"pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p3pr-8f3m-4qp8"],"plain_summary":"GitHub lists this reviewed advisory for pyload-ng. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4e3aca833c44565110fb9c20ede65315"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T15:52:26.000Z","value":"6.4 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4e3aca833c44565110fb9c20ede65315"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4e3aca833c44565110fb9c20ede65315","url":"https://github.com/advisories/GHSA-p3pr-8f3m-4qp8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p3pr-8f3m-4qp8","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:46.371Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4e3aca833c44565110fb9c20ede65315"],"technology":"pyload-ng","known_exclusions":[],"conditions_summary":"## Summary\n\npyLoad ships the WindowsPhoneNotify addon, whose `send()` method opens an HTTP connection to a host taken directly from the plugin's `pushurl` configuration value. A user holding the standard non-admin `SETTINGS` permission can set `pushurl` and `pushid` and enable the addon through the web API, since these plugin options are not in the admin-only option set. Once enabled, the addon activates dynamically without a restart, and any completed download (download events fire globally, not per user) causes the addon to send an HTTP POST to the configured host and path. The request is made with Python's `http.client.HTTPConnection`, so it never passes through pyLoad's pycurl-based outbound connection guard. The attacker can therefore direct blind POST requests at internal hosts such as loopback services, RFC 1918 addresses, or the cloud metadata endpoint `169.254.169.254`.\n\n## Root Cause\n\npyLoad enforces its outbound SSRF protection only inside the pycurl request path, where a `PREREQFUNCTION` callback calls `is_global_address()` on the resolved peer IP before each connection. The WindowsPhoneNotify addon uses a completely separate HTTP client (`http.client.HTTPConnection`) t","public_affected_ranges":["<= 0.5.0b3.dev101"]}],"null_published_at":"2026-10-31T22:27:09.623Z","source_updated_at":"2026-10-26T15:52:26.000Z","source_disclosed_at":"2026-10-09T17:09:03.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:06:46.371Z"}],"next_cursor":null,"snapshot_revision":"42594"}