PT-2026-30897 · Pyload · Pyload

Offset · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-35592

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev97

Description pyLoad is a free and open-source download manager written in Python. The safe extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for path traversal checks, which performs character-level string comparison instead of path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The fix, os.path.commonpath(), was added to the codebase but was not applied to safe extractall(), resulting in an incomplete fix.

Recommendations Update to version 0.5.0b3.dev97 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35592

GHSA-MVWX-582F-56R7

PYSEC-2026-124

Affected Products

Pyload

References · 7

• https://github.com/pyload/pyload/security/advisories/GHSA-mvwx-582f-56r7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35592 · Security Note
• https://osv.dev/vulnerability/GHSA-mvwx-582f-56r7 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-124 · Vendor Advisory
• https://github.com/pyload/pyload · Note
• https://twitter.com/CVEnew/status/2041569997152297395 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041570726033944877 · Twitter Post