Executive brief
pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)
Affected products
- PyPI pyload-ng
Junglewise Threat Intelligence
CVE-2025-54802: PYSEC-2026-493 - pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)
CVE-2025-54802 · Severity: low · CVSS 3.1 · Published 2026-06-29
Technologies: pyload-ng (PyPI). Vendors: PyPI.
Related threats
- pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event
- pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web
- PYSEC-2026-2989 - pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for
- PYSEC-2026-2996 - pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
- PYSEC-2026-1815 - Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs