PT-2026-37263 · Pyload · Pyload

L3Tchupkt · Published 2026-05-05 · Updated 2026-05-15 · CVE-2026-42314

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev100

Description Insufficient sanitization of package folder names allows writing files outside the intended download directory. The issue exists in the add package() function within the src/pyload/core/api/ init .py component. The sanitization process uses string replacement that can be bypassed; specifically, the pattern ....// is partially removed to become .. , leaving .. sequences that the operating system resolves, enabling path traversal. This can be exploited via the /api/set package data endpoint by manipulating the folder variable.

Recommendations Update to version 0.5.0b3.dev100 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-42314

GHSA-97R3-5W84-R4Q8

PYSEC-2026-128

Affected Products

Pyload

References · 8

• 🔥 https://github.com/pyload/pyload/security/advisories/GHSA-97r3-5w84-r4q8 · Exploit
• https://osv.dev/vulnerability/GHSA-97r3-5w84-r4q8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42314 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-128 · Vendor Advisory
• https://github.com/pyload/pyload · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-128.yaml · Note
• https://t.me/cveNotify/163619 · Telegram Post
• https://twitter.com/CVEnew/status/2053932446874521654 · Twitter Post