Executive Summary

CVE-2026-42315 is a high-severity vulnerability in pyload-ng versions up to 0.5.0b3.dev99. It occurs because the set_package_data() API function does not sanitize the "_folder" parameter in the data object. This allows a user with MODIFY permissions to specify arbitrary directories as download locations for packages, enabling path traversal.

Exploitation involves creating a package and then using the set_package_data API to set an absolute path (for example, "/users/root/") as the download folder, which can lead to writing files outside the intended download directory.

This vulnerability is classified under CWE-22 (Improper Limitation of Pathname) and CWE-36 (Absolute Path Traversal) and was fixed in version 0.5.0b3.dev100.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker with MODIFY permissions to write files to arbitrary directories outside the intended download folder. This can compromise the integrity and availability of your system or application.

Because the attacker can specify arbitrary paths, they might overwrite critical files or place malicious files in sensitive locations, potentially leading to system instability or unauthorized code execution.

The CVSS score of 8.1 reflects a high impact on integrity and availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the pyLoad installation is running a vulnerable version (<=0.5.0b3.dev99) and by inspecting usage of the set_package_data() API function, specifically looking for calls where the "_folder" parameter is set to absolute or unexpected directory paths.

You can verify the pyLoad version by running a command like:

• python -m pyload --version

To detect suspicious API usage or configuration, you can search logs or code for calls to set_package_data() with the "_folder" key set to absolute paths or paths outside the expected download directory.

For example, on Linux systems, you might use:

• grep -r 'set_package_data' /path/to/pyload/logs
• grep -r '"_folder"' /path/to/pyload/configs

Additionally, monitoring file system writes outside the normal download directories by the pyLoad process can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade pyLoad to version 0.5.0b3.dev100 or later, where the vulnerability has been fixed.

If upgrading is not immediately possible, restrict MODIFY permissions to trusted users only, preventing untrusted users from calling set_package_data() with arbitrary folder paths.

Additionally, monitor and restrict the directories where pyLoad is allowed to write files, and consider applying file system permissions or sandboxing to limit the impact of potential exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows users with MODIFY permissions to specify arbitrary directories as download locations, potentially enabling writing files outside intended directories. This improper limitation of pathname (CWE-22) and absolute path traversal (CWE-36) can lead to unauthorized modification of files, impacting data integrity and availability.

Such unauthorized file modifications and potential data integrity issues could negatively affect compliance with standards and regulations like GDPR and HIPAA, which require strict controls over data integrity, access, and protection against unauthorized changes.

Useful 0 Not Useful 0