Is CVE-2026-42315 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42315 being exploited in the wild.

How severe is CVE-2026-42315?

High severity, with a CVSS score of 8.1, published 11 May 2026.

Which products and versions are affected?

pyLoad < 0.5.0b3.dev100; pyLoad Next Generation <= 0.5.0b3.dev99; pyload-ng (PyPI) <= 0.5.0b3.dev99, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev100.

Is there a fix for CVE-2026-42315?

Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev100 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42315 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42315?

Check whether you run pyLoad, pyLoad Next Gen, pyLoad Next Generation or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42315: pyLoad path traversal in set_package_data API

Q: Which products and versions are affected?

pyLoad < 0.5.0b3.dev100; pyLoad Next Generation <= 0.5.0b3.dev99; pyload-ng (PyPI) <= 0.5.0b3.dev99, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev100.

Q: Is there a fix for CVE-2026-42315?

Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev100 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42315 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42315?

Check whether you run pyLoad, pyLoad Next Gen, pyLoad Next Generation or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42315 · Severity: high · CVSS 8.1 · Published 2026-05-11

pyLoad, a popular open-source download manager, is vulnerable to a security flaw that allows users with basic modification permissions to change download locations to any folder on the system. An attacker could use this to overwrite sensitive system files or place malicious files in restricted directories, potentially leading to a full system compromise or service disruption. This occurs because the software does not properly check if the requested download folder is safe or restricted.

Technologies: pyLoad, pyLoad Next Gen, pyLoad Next Generation, pyload-ng (PyPI). Vendors: pyLoad, PyPI.

Quick answers

Is CVE-2026-42315 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42315 being exploited in the wild.
How severe is CVE-2026-42315?: High severity, with a CVSS score of 8.1, published 11 May 2026.
Which products and versions are affected?: pyLoad < 0.5.0b3.dev100; pyLoad Next Generation <= 0.5.0b3.dev99; pyload-ng (PyPI) <= 0.5.0b3.dev99, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev100.
Is there a fix for CVE-2026-42315?: Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev100 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42315 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42315?: Check whether you run pyLoad, pyLoad Next Gen, pyLoad Next Generation or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyload-ng (PyPI): upgrade to 0.5.0b3.dev100 or later
```
pip install "pyload-ng>=0.5.0b3.dev100"
```

Technical details

A path traversal vulnerability exists in pyLoad's `set_package_data` API function within `src/pyload/core/api/__init__.py`. The root cause is a lack of sanitization for the `_folder` key in the data object passed to the function. An attacker with `Perms.MODIFY` privileges can provide an absolute path to redirect package downloads to any directory accessible by the pyLoad process. This can be exploited via a network-reachable API call to overwrite critical system files or plant malicious binaries. The issue is addressed in version 0.5.0b3.dev100.

Affected products

pyload pyload-ng <= 0.5.0b3.dev99

Identifiers

CVE-2026-42315
GHSA-838g-gr43-qqg9
PYSEC-2026-129

Timeline

2026-04-27: disclosed: Vulnerability reported by Sab44
2026-05-05: advisory: GitHub Advisory published
2026-05-11: other: NVD published CVE-2026-42315

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.