CVE-2026-35187

@@ -13,11 +13,13 @@
 import time
 from enum import IntFlag
 from typing import Any, Callable, Optional
+from urllib.parse import urlparse
 
 import flask
 from werkzeug.utils import secure_filename
 
 from pyload import PKGDIR
+from pyload.core.utils.web.check import is_global_host
 
 from ..datatypes.data import (
     AccountInfo, CaptchaTask, ConfigItem, ConfigSection, DownloadInfo, EventInfo, FileData, OldUserData, OnlineCheck,
@@ -43,7 +45,7 @@
 
 
 RE_URLMATCH = re.compile(
-    r"(?:https?|ftps?|xdcc|sftp):(?://|\\\\)+[\w\-._~:/?#\[\]@!$&'()*+,;=]*|magnet:\?.+",
+    r"(?:https?|ftps?|xdccs?|sftp):(?://|\\\\)+[\w\-._~:/?#\[\]@!$&'()*+,;=]*|magnet:\?.+",
     re.IGNORECASE,
 )
 
@@ -585,8 +587,11 @@ def parse_urls(self, html: Optional[str] = None, url: Optional[str] = None) -> d
             urls.update(RE_URLMATCH.findall(html))
 
         if url:
-            page = get_url(url)
-            urls.update(RE_URLMATCH.findall(page))
+            urlp = urlparse(url)
+            hostname = urlp.hostname
+            if urlp.scheme in ("http", "https") and hostname and is_global_host(hostname):
+                page = get_url(url)
+                urls.update(RE_URLMATCH.findall(page))
 
         return self.check_urls(list(urls))
 

@@ -4,6 +4,7 @@
 import time
 
 from ...network.request_factory import get_url
+from ..convert import host_to_ip
 
 
 def is_ipv4_address(value):
@@ -100,6 +101,21 @@ def is_global_address(value):
         return False
 
 
+def is_global_host(value):
+    """
+    Check whether the provided host address resolves to a globally routable IP address.
+
+    Parameters:
+    - value (str): The input host to check.
+
+    Returns:
+    - bool: True if the value is a global (publicly routable) host,
+      False for non-global addresses or if the input is invalid.
+    """
+    ips = host_to_ip(value)
+    return ips and all((is_global_address(ip) for ip in ips))
+
+
 def is_port(value):
     """
     Validate whether an integer is a valid TCP/UDP port number.