CVE-2023-47890

pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.

PYSEC-2026-1819 — Download to arbitrary folder can lead to RCE

Affected: PyPI: pyload-ng

### Summary

A web UI user can store files anywhere on the pyLoad server and gain command execution by abusing scripts.

### Details

When a user creates a new package, a subdirectory is created within the /downloads folder to store files. This new directory name is derived from the package name, except a filter is applied to make sure it can't traverse directories and stays within /downloads.

src/pyload/core/api/__init__.py::add_package::L432

```python folder = ( folder.replace("http://", "") .replace("https://", "") .replace(":", "") .replace("/", "_") .replace("\\", "_") ) ```

So if a package were created with the name ```"../"``` the application would instead create the folder ```"/downloads/.._/"```

However, when editing packages there is no prevention in place and a user can just pick any arbitrary directory in the filesystem.

src/pyload/webui/app/blueprints/json_blueprint.py::edit_package::L195

```python id = int(flask.request.form["pack_id"]) data = { "name": flask.request.form["pack_name"], "_folder": flask.request.form["pack_folder"], "password": flask.request.form["pack_pws"], }

api.set_package_data(id, data) ```

### Steps to reproduce

1. Login to a pyLoad instance 2. Go to "Queue" and create a new package with any name and a valid link 3. Click "Edit Package" on the newly created package and set the folder as "/config/scripts/download_finished/" 4. Restart the package 5. Check the server filesy…

Most recent entries from all

CVE-2023-47890

PYSEC-2026-1819 — Download to arbitrary folder can lead to RCE