Is CVE-2026-35592 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35592 being exploited in the wild.

How severe is CVE-2026-35592?

Medium severity, with a CVSS score of 5.3, published 8 April 2026.

Which products and versions are affected?

pyload-ng (PyPI) < 0.5.0b3.dev97, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev97.

Is there a fix for CVE-2026-35592?

Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev97 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35592 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-35592?

Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35592: pyload-ng path traversal in UnTar extraction

Q: Which products and versions are affected?

pyload-ng (PyPI) < 0.5.0b3.dev97, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev97.

Q: Is there a fix for CVE-2026-35592?

Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev97 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-35592 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-35592?

Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35592 · Severity: medium · CVSS 5.3 · Published 2026-04-08

pyload-ng is a download manager that automates file downloads. A vulnerability in its archive extraction component allows a malicious download to write files outside of the intended folder. This could allow an attacker to overwrite system files, plant malicious scripts, or disrupt operations if a user downloads a specially crafted archive.

Technologies: pyload-ng (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-35592 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35592 being exploited in the wild.
How severe is CVE-2026-35592?: Medium severity, with a CVSS score of 5.3, published 8 April 2026.
Which products and versions are affected?: pyload-ng (PyPI) < 0.5.0b3.dev97, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev97.
Is there a fix for CVE-2026-35592?: Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev97 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35592 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-35592?: Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyload-ng (PyPI): upgrade to 0.5.0b3.dev97 or later
```
pip install "pyload-ng>=0.5.0b3.dev97"
```

Technical details

The `_safe_extractall` function in `src/pyload/plugins/extractors/UnTar.py` implements a path traversal check using `os.path.commonprefix()`. Because this function performs character-level string comparison rather than path-component comparison, it can be bypassed using sibling directory names that share a common string prefix (e.g., `/downloads/pkg` vs `/downloads/pkg_evil`). An attacker can craft a Tar archive with members containing `..` sequences that resolve to locations outside the extraction directory. Exploitation requires the 'ExtractArchive' addon to be enabled and the victim to download a malicious archive. The vulnerability is addressed in version 0.5.0b3.dev97 by using `os.path.commonpath()`.

Affected products

pyload pyload-ng < 0.5.0b3.dev97

Identifiers

CVE-2026-35592
GHSA-mvwx-582f-56r7
PYSEC-2026-124

Timeline

2026-04-07: advisory: NVD publication date
2026-04-08: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.