PT-2026-26508 · Pyload · Pyload

Thesmartshadow · CVE-2026-32808 · Publicado 2026-03-20 · Atualizado 2026-05-28

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev97

Description pyLoad, a free and open-source download manager written in Python, is affected by a path traversal issue. This occurs during password verification of specific encrypted 7z archives – those encrypted with non-encrypted headers. The issue allows for arbitrary file deletion outside of the intended extraction directory. The software derives an archive entry name from 7z listing output and incorrectly treats it as a filesystem path without restricting it to the extraction directory.

Recommendations Update to version 0.5.0b3.dev97 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-32808

GHSA-7G4M-8HX2-4QH3

Produtos afetados

Pyload

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32808.json · Exploit
• https://github.com/pyload/pyload/security/advisories/GHSA-7g4m-8hx2-4qh3 · Aviso do Fabricante
• https://twitter.com/Alishmery2/status/2060059558966362549 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32808 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32808 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034841448349409721 · Publicação no Twitter