PT-2026-26508 · Pyload · Pyload

Thesmartshadow · CVE-2026-32808 · Published 2026-03-20 · Updated 2026-05-28

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev97

Description pyLoad, a free and open-source download manager written in Python, is affected by a path traversal issue. This occurs during password verification of specific encrypted 7z archives – those encrypted with non-encrypted headers. The issue allows for arbitrary file deletion outside of the intended extraction directory. The software derives an archive entry name from 7z listing output and incorrectly treats it as a filesystem path without restricting it to the extraction directory.

Recommendations Update to version 0.5.0b3.dev97 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32808

GHSA-7G4M-8HX2-4QH3

Affected Products

Pyload

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32808.json · Exploit
• https://github.com/pyload/pyload/security/advisories/GHSA-7g4m-8hx2-4qh3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32808 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32808 · Security Note
• https://twitter.com/Alishmery2/status/2060059558966362549 · Twitter Post
• https://twitter.com/CVEnew/status/2034841448349409721 · Twitter Post