pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated path traversal vulnerability exists in the /json/upload endpoint of pyLoad. By manipulating the filename of an uploaded file, an attacker can traverse out of the intended upload directory, allowing them to write arbitrary files to any location on the system accessible to the pyLoad process. This may lead to: Remote Code Execution (RCE), local privilege escalation, system-wide compromise, persistence, and backdoors. This is fixed in version 0.5.0b3.dev90.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pyload | pyload | 0.5.0b3.dev89 to before 0.5.0b3.dev90 | 0.5.0b3.dev90 | Patch available | CNA |
| — | pyload-ng (PyPI) | 0.5.0b3.dev89 to before 0.5.0b3.dev90 | 0.5.0b3.dev90 | Patch available | GHSA-xqpg-92fq-grfg |
- pyload Vendorpyload Affected 0.5.0b3.dev89 to before 0.5.0b3.dev90 Fixed in 0.5.0b3.dev90 Patch available CNA
- pyload-ng (PyPI) Vendor— Affected 0.5.0b3.dev89 to before 0.5.0b3.dev90 Fixed in 0.5.0b3.dev90 Patch available GHSA-xqpg-92fq-grfg
Remediation
- Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev90
- Fix · GHSA-xqpg-92fq-grfg pyload-ng (PyPI) Fixed in 0.5.0b3.dev90 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54140
- 2026-10-03 Alias added: GHSA-xqpg-92fq-grfg
- 2026-10-12 EPSS moved to the 50th–90th percentile
References
Other 4
- https://github.com/pyload/pyload/security/advisories/GHSA-xqpg-92fq-grfg
- https://github.com/pyload/pyload/commit/fc4b136e9c4e7dcbb8e467ae802cb2c3f70a71b0
- https://github.com/pyload/pyload/blob/df094db67ec6e25294a9ac0ddb4375fd7fb9ba00/src/pyload/webui/app/blueprints/json_blueprint.py#L109
- https://github.com/pyload/pyload
More pyload vulnerabilities
- TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
- TI-2025-34556 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
- TI-2025-33765 pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVSS 3.1CRITICAL 9.8
- TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
- TI-2026-27589 pyLoad has SSRF fix bypass via HTTP redirect CVSS 4.0CRITICAL 9.3
- TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
Sources
- CVE-2025-54140 · CVE Program
- CVE-2025-54140 · NVD
- FIRST EPSS
- GHSA-xqpg-92fq-grfg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences