CVE-2026-29778: pyLoad path traversal in edit_package

Executive brief

pyLoad, an open-source download manager, is vulnerable to a security flaw that allows authenticated users to write files to unauthorized locations on the server. By bypassing folder name restrictions, an attacker could potentially overwrite sensitive system files or disrupt operations. This could lead to a loss of system integrity or service availability.

Technical details

A path traversal vulnerability exists in the edit_package() function of pyLoad. The root cause is an insufficient sanitization mechanism that uses a single-pass string replacement to remove '../' sequences from the 'pack_folder' parameter. An authenticated attacker with MODIFY permissions can bypass this by using nested sequences like '..././', which resolve to traversal patterns after the single-pass filter. This allows the attacker to escape the intended storage directory and write files to arbitrary locations on the filesystem. The issue is fixed in version 0.5.0b3.dev97.

Affected products

• pyLoad pyload-ng >= 0.5.0b3.dev13, <= 0.5.0b3.dev96

Timeline

• 2026-03-04: disclosed
• 2026-03-05: advisory: GHSA-6px9-j4qr-xfjw published

References

• https://api.github.com/users/BaranTeyin1
• https://github.com/BaranTeyin1
• https://api.github.com/users/BaranTeyin1/gists%7B/gist_id%7D
• https://api.github.com/users/BaranTeyin1/repos
• https://avatars.githubusercontent.com/u/193125235?v=4
• https://api.github.com/users/BaranTeyin1/events%7B/privacy%7D