Read the docs
TI-2026-29242 Aliases CVE-2026-40491GHSA-76hw-p97h-883f

gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall

Priority HIGH 67CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00575 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed gdown (wkentaro): 5.2.2gdown (PyPI): 5.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wkentarogdownbefore 5.2.25.2.2Patch availableCNA
—gdown (PyPI)before 5.2.25.2.2Patch availableGHSA-76hw-p97h-883f
  • gdown Vendorwkentaro Affected before 5.2.2 Fixed in 5.2.2 Patch available CNA
  • gdown (PyPI) Vendor— Affected before 5.2.2 Fixed in 5.2.2 Patch available GHSA-76hw-p97h-883f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wkentaro:gdown:*:*:*:*:*:*:*:*before 5.2.2Vulnerablewkentaro
  • cpe:2.3:a:wkentaro:gdown:*:*:*:*:*:*:*:* Versions before 5.2.2 Vulnerable ·wkentaro

Remediation

  • Fix · CNA gdown (wkentaro) Fixed in 5.2.2
  • Fix · GHSA-76hw-p97h-883f gdown (PyPI) Fixed in 5.2.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40491
  2. 2026-10-03 Alias added: GHSA-76hw-p97h-883f
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences