TI-2026-25278 Aliases CVE-2026-32808

pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification

HIGH 68CWE-22Published 2026-03-20 · Updated 2026-03-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside of the extraction directory. During password verification, pyLoad derives an archive entry name from 7z listing output and treats it as a filesystem path without constraining it to the extraction directory. This issue has been fixed in version 0.5.0b3.dev97.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0034 27th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed pyload (pyload): 0.5.0b3.dev97

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pyload	pyload	0.4.9-6262-g2fa0b11d3 to before 0.5.0b3.dev97	0.5.0b3.dev97	Patch available	CNA

pyload Vendorpyload Affected 0.4.9-6262-g2fa0b11d3 to before 0.5.0b3.dev97 Fixed in 0.5.0b3.dev97 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:pyload:pyload::::::::	up to 0.4.20	Vulnerable	pyload
cpe:2.3:a:pyload-ng_project:pyload-ng::::::python::*	0.5.0a5.dev528 to before 0.5.0b3.dev97	Vulnerable	Pyload-ng Project

cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:* Versions up to 0.4.20 Vulnerable ·pyload
cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:* Versions 0.5.0a5.dev528 to before 0.5.0b3.dev97 Vulnerable ·Pyload-ng Project

Remediation

Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev97

Timeline

2026-10-02 Threatist record created from CVE-2026-32808

References

Exploit 1

https://github.com/pyload/pyload/security/advisories/GHSA-7g4m-8hx2-4qh3

TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
TI-2026-25907 pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad CVSS 4.0HIGH 8.8
TI-2024-32088 pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API CVSS 3.1CRITICAL 9.1
TI-2026-29761 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) CVSS 3.1HIGH 8.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences