Executive brief
pyLoad, a popular open-source download manager, is vulnerable to a security flaw that allows users with basic modification permissions to change download locations to any folder on the system. An attacker could use this to overwrite sensitive system files or place malicious files in restricted directories, potentially leading to a full system compromise or service disruption. This occurs because the software does not properly check if the requested download folder is safe or restricted.
Technical details
A path traversal vulnerability exists in pyLoad's `set_package_data` API function within `src/pyload/core/api/__init__.py`. The root cause is a lack of sanitization for the `_folder` key in the data object passed to the function. An attacker with `Perms.MODIFY` privileges can provide an absolute path to redirect package downloads to any directory accessible by the pyLoad process. This can be exploited via a network-reachable API call to overwrite critical system files or plant malicious binaries. The issue is addressed in version 0.5.0b3.dev100.
Affected products
- pyload pyload-ng <= 0.5.0b3.dev99
Timeline
- 2026-04-27: disclosed: Vulnerability reported by Sab44
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: other: NVD published CVE-2026-42315