# CVE-2026-42315: pyLoad path traversal in set_package_data API

Source: https://junglewise.ai/threats/cve-2026-42315-pyload-path-traversal-in-set-package-data-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-42315 · Severity: high · CVSS 8.1 · Published 2026-05-11

pyLoad, a popular open-source download manager, is vulnerable to a security flaw that allows users with basic modification permissions to change download locations to any folder on the system. An attacker could use this to overwrite sensitive system files or place malicious files in restricted directories, potentially leading to a full system compromise or service disruption. This occurs because the software does not properly check if the requested download folder is safe or restricted.

Technologies: [pyLoad](https://junglewise.ai/threats/technologies/pyload), [pyLoad Next Gen](https://junglewise.ai/threats/technologies/pyload-next-gen), [pyLoad Next Generation](https://junglewise.ai/threats/technologies/pyload-next-generation), [pyload-ng (PyPI)](https://junglewise.ai/threats/technologies/pyload-ng). Vendors: [pyLoad](https://junglewise.ai/threats/vendors/pyload), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-42315 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42315 being exploited in the wild.

**How severe is CVE-2026-42315?** High severity, with a CVSS score of 8.1, published 11 May 2026.

**Which products and versions are affected?** pyLoad < 0.5.0b3.dev100; pyLoad Next Generation <= 0.5.0b3.dev99; pyload-ng (PyPI) <= 0.5.0b3.dev99, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev100.

**Is there a fix for CVE-2026-42315?** Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev100 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42315 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42315?** Check whether you run pyLoad, pyLoad Next Gen, pyLoad Next Generation or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pyload-ng (PyPI): upgrade to 0.5.0b3.dev100 or later

  ```sh
  pip install "pyload-ng>=0.5.0b3.dev100"
  ```


## Technical details

A path traversal vulnerability exists in pyLoad's `set_package_data` API function within `src/pyload/core/api/__init__.py`. The root cause is a lack of sanitization for the `_folder` key in the data object passed to the function. An attacker with `Perms.MODIFY` privileges can provide an absolute path to redirect package downloads to any directory accessible by the pyLoad process. This can be exploited via a network-reachable API call to overwrite critical system files or plant malicious binaries. The issue is addressed in version 0.5.0b3.dev100.

## Affected products

- pyload pyload-ng <= 0.5.0b3.dev99

## Identifiers

- CVE-2026-42315
- GHSA-838g-gr43-qqg9
- PYSEC-2026-129

## Timeline

- 2026-04-27: disclosed: Vulnerability reported by Sab44
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: other: NVD published CVE-2026-42315

## References

- [https://api.github.com/users/Sab44](https://api.github.com/users/Sab44)
- [https://github.com/Sab44](https://github.com/Sab44)
- [https://api.github.com/users/Sab44/gists%7B/gist_id%7D](https://api.github.com/users/Sab44/gists%7B/gist_id%7D)
- [https://api.github.com/users/Sab44/repos](https://api.github.com/users/Sab44/repos)
- [https://avatars.githubusercontent.com/u/64696149?v=4](https://avatars.githubusercontent.com/u/64696149?v=4)
- [https://api.github.com/users/Sab44/events%7B/privacy%7D](https://api.github.com/users/Sab44/events%7B/privacy%7D)

## Related threats

- [pyLoad API key validation cache authentication bypass](https://junglewise.ai/threats/cve-2026-123816-pyload-is-a-free-and-open-source-download-manager-written-in)
- [pyLoad WindowsPhoneNotify SSRF in notification addon](https://junglewise.ai/threats/cve-2026-123814-pyload-is-a-free-and-open-source-download-manager-written-in)
- [pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses)
- [pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service)
- [pyload-ng authentication bypass in getUserData/get_userdata](https://junglewise.ai/threats/pyload-ng-getuserdata-get-userdata-exposed-at-perms-any-allow-any-cd197c9d)