CVE-2026-48737

Improper IPv6 address validation allows bypass of global‑host checks, enabling internal network access.

• CVSS 4.9
• 918
• Information Leakage
• Remote

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user can submit an IPv6 literal through parse_urls to the pre-resolution is_global_host guard. Because host_to_ip is pinned to AF_INET, that guard does not evaluate a hostname's AAAA result. Separately, curl resolves hostnames before the pycurl PREREQFUNC in src/pyload/core/network/http/http_request.py applies the same vulnerable is_global_address check to the actual connection address, so a transition-form AAAA result can be permitted even when it terminates at an embedded loopback, private, CGNAT, or link-local IPv4 address. Exploitation requires the pyLoad host to route the applicable transition mechanism, including 6to4 on affected Python 3.9 through 3.11 deployments or NAT64 on a network with a NAT64 gateway. Successful exploitation can enable internal-network reconnaissance, timing-based confirmation, limited service disruption, or cloud metadata disclosure where the wrapped address is routable. This issue is fixed in version 0.5.0b3.dev101.

CVE

CVE-2026-48737

CWE

918

CVSS base score

4.9

Published

2026-09-15

OWASP

A04 Insecure Design

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

pyLoad

Fixed by upgrading

Yes

Solution

Upgrade pyLoad to version 0.5.0b3.dev101 (or later).

import ipaddress
import socket

def is_global_address(host: str) -> bool:
    """
    Return True if the host resolves to a globally routable address.
    Vulnerable: does not consider IPv4 addresses embedded in IPv6 (6to4/NAT64).
    """
    # VULNERABLE: missing IPv4‑in‑IPv6 check
    try:
        ip = ipaddress.ip_address(host)
    except ValueError:
        # Resolve hostname (AF_INET only) – AAAA results are ignored
        try:
            ip = ipaddress.ip_address(socket.gethostbyname(host))
        except OSError:
            return False
    return ip.is_global

def parse_urls(urls):
    """Parse a list of URLs and reject non‑global hosts."""
    for url in urls:
        host = url.split('://', 1)[-1].split('/', 1)[0].split(':', 1)[0]
        if not is_global_address(host):
            raise ValueError(f"Disallowed host: {host}")
        # further processing ...

import ipaddress
import socket

def is_global_address(host: str) -> bool:
    """
    Return True if the host resolves to a globally routable address.
    Fix: also rejects IPv4 addresses embedded in IPv6 (6to4/NAT64).
    """
    # FIX: include IPv4‑in‑IPv6 detection
    try:
        ip = ipaddress.ip_address(host)
    except ValueError:
        # Resolve hostname (AF_INET only) – AAAA results are ignored
        try:
            ip = ipaddress.ip_address(socket.gethostbyname(host))
        except OSError:
            return False

    # Reject IPv4‑mapped or IPv4‑compatible IPv6 addresses
    if ip.version == 6 and ip.ipv4_mapped:
        return False
    return ip.is_global

def parse_urls(urls):
    """Parse a list of URLs and reject non‑global hosts."""
    for url in urls:
        host = url.split('://', 1)[-1].split('/', 1)[0].split(':', 1)[0]
        if not is_global_address(host):
            raise ValueError(f"Disallowed host: {host}")
        # further processing ...

@misc{vaitp:cve202648737,
  title        = {{Improper IPv6 address validation allows bypass of global‑host checks, enabling internal network access.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-48737},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-48737/}}
}