Vulnerabilities

Security research · GHSA-p3pr-8f3m-4qp8

pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

Published Oct 9, 2026 · catalog updated Oct 26, 2026 · pyLoad WindowsPhoneNotify addon: non-admin

Last checked Oct 26, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-p3pr-8f3m-4qp8. A missing EPSS score is not a low risk. Compare pyLoad WindowsPhoneNotify addon: non-admin with the linked advisory before you change production.

Severity

Medium6.4

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Advisory link

Affected products

PyPI pyload-ng

## Summary pyLoad ships the WindowsPhoneNotify addon, whose method opens an HTTP connection to a host taken directly from the plugin's configuration value. A user holding the standard non-admin permission can set and and enable the addon through the web API, since these plugin options are not in the admin-only option set. Once enabled, the addon activates dynamically without a restart, and any completed download (download events fire globally, not per user) causes the addon to send an HTTP POST to the configured host and path. The request is made with Python's , so it never passes through pyLoad's pycurl-based outbound connection guard. The attacker can therefore direct blind POST requests at internal hosts such as loopback services, RFC 1918 addresses, or the cloud metadata endpoint . ## Root Cause pyLoad enforces its outbound SSRF protection only inside the pycurl request path, where a callback calls on the resolved peer IP before each connection. The WindowsPhoneNotify addon uses a completely separate HTTP client ( ) that is never subjected to that callback and performs no address validation of its own. In addition, the API config-write authorization only guards a narrow hard-coded set of plugin options, which does not include the WindowsPhoneNotify host and path fields, so a non-admin user can point the notifier at any destination. ## Impact An authenticated user with the non-admin permission can cause the pyLoad server to issue blind HTTP POST requests to arbitrary internal hosts, ports, and paths that the user cannot reach directly. The attacker controls the destination host and port ( ), the request path ( ), and part of the XML request body (through file and package names surfaced in the notification text). Because the request is blind, response bodies are not returned; the demonstrated capability is internal service discovery, port and host probing through timing or error differences, cloud metadata endpoint reachability where the network routes it, and tri