Read the docs
TI-2025-34556 Aliases CVE-2025-54802GHSA-48rp-jc79-2264

pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)

Priority HIGH 82CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE). The addcrypted endpoint in pyload-ng suffers from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside the designated storage directory. This can be abused to overwrite critical system files, including cron jobs and systemd services, leading to privilege escalation and remote code execution as root. This issue is fixed in version 0.5.0b3.dev90.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0139 72nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed pyload (pyload): 0.5.0b3.dev90pyload-ng (PyPI): 0.5.0b3.dev90

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pyloadpyload0.5.0b3.dev89 to before 0.5.0b3.dev900.5.0b3.dev90Patch availableCNA
—pyload-ng (PyPI)before 0.5.0b3.dev900.5.0b3.dev90Patch availableGHSA-48rp-jc79-2264
  • pyload Vendorpyload Affected 0.5.0b3.dev89 to before 0.5.0b3.dev90 Fixed in 0.5.0b3.dev90 Patch available CNA
  • pyload-ng (PyPI) Vendor— Affected before 0.5.0b3.dev90 Fixed in 0.5.0b3.dev90 Patch available GHSA-48rp-jc79-2264

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev89:*:*:*:*:python:*:*0.5.0b3.dev89VulnerablePyload-ng Project
  • cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev89:*:*:*:*:python:*:* Versions 0.5.0b3.dev89 Vulnerable ·Pyload-ng Project

Remediation

  • Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev90
  • Fix · GHSA-48rp-jc79-2264 pyload-ng (PyPI) Fixed in 0.5.0b3.dev90 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54802
  2. 2026-10-03 Alias added: GHSA-48rp-jc79-2264

References

Exploit 2

Patch 1

Advisory 1

Other 1

  • TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2025-33765 pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVSS 3.1CRITICAL 9.8
  • TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2026-27589 pyLoad has SSRF fix bypass via HTTP redirect CVSS 4.0CRITICAL 9.3
  • TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
  • TI-2026-25907 pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad CVSS 4.0HIGH 8.8
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences