CVE-2026-40491 Details
Description
gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.
A path traversal vulnerability has been identified in the gdown library, specifically in versions prior to 5.2.2. The issue arises within the extractall function, where the library fails to properly sanitize or validate filenames when extracting ZIP or TAR archives. This oversight allows maliciously crafted archives to write files outside the intended directory, potentially overwriting critical files and leading to remote code execution. The vulnerability exists in gdown/extractall.py, where the extractall function calls the extraction methods of Python's tarfile or zipfile modules without validating the archive members' paths.
Users can update to gdown version 5.2.2 or later, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the gdown GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wkentaro gdown | < 5.2.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 18, 2026 | New CVE Received | [email protected] |