pyLoad: Path Traversal via Package Folder Name
Priority MEDIUM 62CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.dev100.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00342 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pyload (pyload): 0.5.0b3.dev100pyload-ng (PyPI): 0.5.0b3.dev100
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pyload | pyload | before 0.5.0b3.dev100 | 0.5.0b3.dev100 | Patch available | CNA |
| — | pyload-ng (PyPI) | before 0.5.0b3.dev100 | 0.5.0b3.dev100 | Patch available | GHSA-97r3-5w84-r4q8 |
- pyload Vendorpyload Affected before 0.5.0b3.dev100 Fixed in 0.5.0b3.dev100 Patch available CNA
- pyload-ng (PyPI) Vendor— Affected before 0.5.0b3.dev100 Fixed in 0.5.0b3.dev100 Patch available GHSA-97r3-5w84-r4q8
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:* | before 0.5.0b3.dev100 | Vulnerable | Pyload-ng Project |
- cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:* Versions before 0.5.0b3.dev100 Vulnerable ·Pyload-ng Project
Remediation
- Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev100
- Fix · GHSA-97r3-5w84-r4q8 pyload-ng (PyPI) Fixed in 0.5.0b3.dev100 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42314
- 2026-10-03 Alias added: GHSA-97r3-5w84-r4q8
References
More pyload vulnerabilities
- TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
- TI-2025-34556 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
- TI-2025-33765 pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVSS 3.1CRITICAL 9.8
- TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
- TI-2026-27589 pyLoad has SSRF fix bypass via HTTP redirect CVSS 4.0CRITICAL 9.3
- TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-42314 · CVE Program
- CVE-2026-42314 · NVD
- FIRST EPSS
- GHSA-97r3-5w84-r4q8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences