Executive brief
pyLoad, a popular open-source download manager, is vulnerable to a security flaw that allows users to save files in unauthorized locations on the server. By using specially crafted folder names, an authenticated user can bypass security filters to write or overwrite files outside of the designated download directory. This could lead to the corruption of system files or the placement of malicious content in sensitive areas of the server's storage.
Technical details
A path traversal vulnerability exists in pyLoad's 'add_package' and 'set_package_data' API endpoints due to insufficient sanitization of the 'folder' parameter. The sanitization logic uses simple string replacement (e.g., replacing '../' with '_') which can be bypassed using nested patterns like '....//'. When the OS resolves the resulting path, the '..' sequences remain effective, allowing an attacker with 'ADD' permissions to escape the restricted download directory. This can be used to write files to arbitrary locations on the filesystem, potentially leading to system file overwrites or unauthorized data placement. The issue is fixed in version 0.5.0b3.dev100.
Affected products
- pyLoad pyload-ng <= 0.5.0b3.dev79
Timeline
- 2026-04-26: disclosed: Vulnerability reported to vendor
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: other: NVD published CVE-2026-42314