PT-2025-30362 · Pyload · Pyload

Published 2025-07-21 · Updated 2025-07-23 · CVE-2025-54140

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev90

Description pyLoad contains an authenticated path traversal vulnerability in the /json/upload endpoint. By manipulating the filename of an uploaded file, an attacker can traverse out of the intended upload directory and write arbitrary files to any location on the system accessible to the pyLoad process. This could lead to Remote Code Execution (RCE), local privilege escalation, system-wide compromise, and persistence. The vulnerable code resides in src/pyload/webui/app/blueprints/json blueprint.py and lacks sanitization or validation of the file.filename variable, allowing traversal via ../../ sequences.

Recommendations pyLoad versions prior to 0.5.0b3.dev90 should be updated to version 0.5.0b3.dev90 or later.

Exploit

Fix

LPE

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-54140

GHSA-XQPG-92FQ-GRFG

Affected Products

Pyload

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54140.json · Exploit
• https://osv.dev/vulnerability/GHSA-xqpg-92fq-grfg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54140 · Security Note
• https://github.com/pyload/pyload · Note
• https://github.com/pyload/pyload/commit/fc4b136e9c4e7dcbb8e467ae802cb2c3f70a71b0 · Note
• https://github.com/pyload/pyload/blob/df094db67ec6e25294a9ac0ddb4375fd7fb9ba00/src/pyload/webui/app/blueprints/json_blueprint.py#L109 · Note
• https://github.com/pyload/pyload/security/advisories/GHSA-xqpg-92fq-grfg · Note
• https://twitter.com/CVEnew/status/1947776819413061897 · Twitter Post
• https://t.me/cvetracker/28424 · Telegram Post
• https://t.me/CVEtracker/28424 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947863128697397272 · Twitter Post