PT-2026-23442 · Pyload · Pyload

Baranteyin1

+1

·

Published

2026-03-05

·

Updated

2026-03-12

·

CVE-2026-29778

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Name of the Vulnerable Software and Affected Versions pyLoad versions 0.5.0b3.dev13 through 0.5.0b3.dev96
Description pyLoad contains a flaw in the edit package() function where insufficient sanitization of the pack folder parameter allows for path traversal. The existing protection uses a single replacement of "../", which can be bypassed with crafted recursive traversal sequences like ..././..././..././tmp. A successful exploit allows an authenticated user with MODIFY permission to write files to arbitrary locations, such as /tmp, by escaping the intended storage directory. The issue is triggered by submitting a payload similar to pack folder=..././..././..././tmp, which after the single-pass replacement becomes ../../../tmp.
Recommendations Update to version 0.5.0b3.dev97 or later.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-29778
GHSA-6PX9-J4QR-XFJW
PYSEC-2026-121

Affected Products

Pyload