CVE-2026-42315
Path Traversal in pyLoad Download Manager
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pyload | pyload | to 0.5.0b3.dev100 (exc) |
| pyload | pyload | 0.5.0b3.dev100 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-36 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows users with MODIFY permissions to specify arbitrary directories as download locations, potentially enabling writing files outside intended directories. This improper limitation of pathname (CWE-22) and absolute path traversal (CWE-36) can lead to unauthorized modification of files, impacting data integrity and availability.
Such unauthorized file modifications and potential data integrity issues could negatively affect compliance with standards and regulations like GDPR and HIPAA, which require strict controls over data integrity, access, and protection against unauthorized changes.
Can you explain this vulnerability to me?
CVE-2026-42315 is a high-severity vulnerability in pyload-ng versions up to 0.5.0b3.dev99. It occurs because the set_package_data() API function does not sanitize the "_folder" parameter in the data object. This allows a user with MODIFY permissions to specify arbitrary directories as download locations for packages, enabling path traversal.
Exploitation involves creating a package and then using the set_package_data API to set an absolute path (for example, "/users/root/") as the download folder, which can lead to writing files outside the intended download directory.
This vulnerability is classified under CWE-22 (Improper Limitation of Pathname) and CWE-36 (Absolute Path Traversal) and was fixed in version 0.5.0b3.dev100.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker with MODIFY permissions to write files to arbitrary directories outside the intended download folder. This can compromise the integrity and availability of your system or application.
Because the attacker can specify arbitrary paths, they might overwrite critical files or place malicious files in sensitive locations, potentially leading to system instability or unauthorized code execution.
The CVSS score of 8.1 reflects a high impact on integrity and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the pyLoad installation is running a vulnerable version (<=0.5.0b3.dev99) and by inspecting usage of the set_package_data() API function, specifically looking for calls where the "_folder" parameter is set to absolute or unexpected directory paths.
You can verify the pyLoad version by running a command like:
- python -m pyload --version
To detect suspicious API usage or configuration, you can search logs or code for calls to set_package_data() with the "_folder" key set to absolute paths or paths outside the expected download directory.
For example, on Linux systems, you might use:
- grep -r 'set_package_data' /path/to/pyload/logs
- grep -r '"_folder"' /path/to/pyload/configs
Additionally, monitoring file system writes outside the normal download directories by the pyLoad process can help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade pyLoad to version 0.5.0b3.dev100 or later, where the vulnerability has been fixed.
If upgrading is not immediately possible, restrict MODIFY permissions to trusted users only, preventing untrusted users from calling set_package_data() with arbitrary folder paths.
Additionally, monitor and restrict the directories where pyLoad is allowed to write files, and consider applying file system permissions or sandboxing to limit the impact of potential exploitation.