CVE-2026-32808 Details
Description
pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside of the extraction directory. During password verification, pyLoad derives an archive entry name from 7z listing output and treats it as a filesystem path without constraining it to the extraction directory. This issue has been fixed in version 0.5.0b3.dev97.
A path traversal vulnerability allowing arbitrary file deletion has been identified in pyLoad versions prior to 0.5.0b3.dev97. This issue arises during password verification of certain encrypted 7z archives, specifically those with non-encrypted headers. The vulnerability occurs because pyLoad improperly handles archive entry names derived from the 7z listing output, treating them as filesystem paths without proper validation. As a result, an attacker can manipulate the entry names to include path traversal sequences, leading to the deletion of files outside the designated extraction directory.
Users can upgrade to pyLoad-ng version 0.5.0b3.dev97 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pyload/pyload/security/advisories/GHSA-7g4m-8hx2-4qh3 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pyload pyload | <= 0.4.20 |
CPE
Remediation
| |
| pyload-ng project pyload-ng | >= 0.5.0a5.dev528, < 0.5.0b3.dev97 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |