CVE-2026-29778
Directory Traversal in pyLoad edit_package() Allows Path Bypass
Publication date: 2026-03-07
Last updated on: 2026-03-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pyload-ng_project | pyload-ng | From 0.5.0b3.dev13 (inc) to 0.5.0b3.dev97 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-23 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-29778 is an arbitrary file write vulnerability in the pyload-ng package, specifically in the edit_package() function. This function tries to sanitize the pack_folder parameter to prevent directory traversal attacks by replacing "../" sequences once. However, this single-pass replacement can be bypassed using crafted recursive traversal sequences like "..././..././..././tmp", which after normalization become paths that escape the intended directory.'}, {'type': 'paragraph', 'content': 'As a result, an attacker with authenticated access and MODIFY permissions can write files to arbitrary locations on the system, such as the /tmp directory, potentially modifying files outside the allowed storage area.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability allows an attacker with authenticated MODIFY permissions to write files to arbitrary locations on the system, which can lead to unauthorized modification of files (high integrity impact).'}, {'type': 'paragraph', 'content': "Such unauthorized file writes can be exploited to alter application behavior, inject malicious code, or disrupt system operations, potentially compromising the affected system's integrity and reliability."}, {'type': 'paragraph', 'content': 'The attack can be performed remotely with low complexity and does not require user interaction, increasing the risk of exploitation.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves an arbitrary file write via path traversal in the edit_package() function of pyload-ng, specifically through crafted payloads in the pack_folder parameter.'}, {'type': 'paragraph', 'content': "Detection can focus on monitoring for suspicious requests or inputs containing recursive traversal sequences such as '..././..././..././' which bypass the single-pass '../' sanitization."}, {'type': 'paragraph', 'content': 'Since exploitation requires an authenticated user with MODIFY permissions, reviewing logs for unusual modification attempts or unexpected file writes outside the intended directories can help detect exploitation.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect potential exploitation attempts include searching application logs or request logs for patterns like:'}, {'type': 'list_item', 'content': 'grep -r "..././..././" /path/to/pyload/logs'}, {'type': 'list_item', 'content': 'grep -r "pack_folder" /path/to/pyload/logs | grep "..././"'}, {'type': 'list_item', 'content': 'Monitoring file system changes outside the expected directories, for example using:'}, {'type': 'list_item', 'content': "find / -type f -newermt 'YYYY-MM-DD' -exec ls -l {} \\;"}, {'type': 'paragraph', 'content': 'Additionally, network monitoring tools can be configured to alert on suspicious payloads containing recursive traversal sequences in HTTP requests.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade pyload-ng to version 0.5.0b3.dev97 or later, where the vulnerability has been patched.
Until the upgrade can be applied, restrict MODIFY permissions to trusted users only, as exploitation requires authenticated users with such privileges.
Implement additional input validation or sanitization on the pack_folder parameter to prevent recursive traversal sequences.
Monitor logs and file system activity for signs of exploitation attempts and respond accordingly.