Is CVE-2026-42314 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42314 being exploited in the wild.

How severe is CVE-2026-42314?

Medium severity, with a CVSS score of 6.5, published 11 May 2026.

Which products and versions are affected?

pyLoad Next Generation < 0.5.0b3.dev100; pyload-ng (PyPI) <= 0.5.0b3.dev79, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev100.

Is there a fix for CVE-2026-42314?

Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev100 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42314 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42314?

Check whether you run pyLoad Next Gen, pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42314: pyLoad path traversal in package folder name sanitization

Q: Is there a fix for CVE-2026-42314?

Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev100 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42314 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42314?

Check whether you run pyLoad Next Gen, pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42314 · Severity: medium · CVSS 6.5 · Published 2026-05-11

pyLoad, a popular open-source download manager, is vulnerable to a security flaw that allows users to save files in unauthorized locations on the server. By using specially crafted folder names, an authenticated user can bypass security filters to write or overwrite files outside of the designated download directory. This could lead to the corruption of system files or the placement of malicious content in sensitive areas of the server's storage.

Technologies: pyLoad Next Gen, pyLoad Next Generation, pyload-ng (PyPI). Vendors: pyLoad, PyPI.

Quick answers

Is CVE-2026-42314 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42314 being exploited in the wild.
How severe is CVE-2026-42314?: Medium severity, with a CVSS score of 6.5, published 11 May 2026.
Which products and versions are affected?: pyLoad Next Generation < 0.5.0b3.dev100; pyload-ng (PyPI) <= 0.5.0b3.dev79, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev100.
Is there a fix for CVE-2026-42314?: Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev100 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42314 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42314?: Check whether you run pyLoad Next Gen, pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyload-ng (PyPI): upgrade to 0.5.0b3.dev100 or later
```
pip install "pyload-ng>=0.5.0b3.dev100"
```

Technical details

A path traversal vulnerability exists in pyLoad's 'add_package' and 'set_package_data' API endpoints due to insufficient sanitization of the 'folder' parameter. The sanitization logic uses simple string replacement (e.g., replacing '../' with '_') which can be bypassed using nested patterns like '....//'. When the OS resolves the resulting path, the '..' sequences remain effective, allowing an attacker with 'ADD' permissions to escape the restricted download directory. This can be used to write files to arbitrary locations on the filesystem, potentially leading to system file overwrites or unauthorized data placement. The issue is fixed in version 0.5.0b3.dev100.

Affected products

pyLoad pyload-ng <= 0.5.0b3.dev79

Identifiers

CVE-2026-42314
GHSA-97r3-5w84-r4q8
PYSEC-2026-128

Timeline

2026-04-26: disclosed: Vulnerability reported to vendor
2026-05-05: advisory: GitHub Advisory published
2026-05-11: other: NVD published CVE-2026-42314

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.