CVE-2026-42314 Details
Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.dev100.
A path traversal vulnerability has been identified in pyLoad, a Python-based download manager, in versions through 0.5.0b3.dev79. The issue arises from inadequate sanitization of package folder names, which allows for writing files outside the designated download directory. The vulnerability is exploited by creating a package with a malicious folder name that bypasses the sanitization process, leaving behind '..' sequences that the operating system can resolve to access unintended file paths. This flaw could potentially be used to overwrite system files or clutter directories with downloaded content.
Users can upgrade to pyLoad version 0.5.0b3.dev100 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pyload/pyload/security/advisories/GHSA-97r3-5w84-r4q8 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/pyload/pyload/security/advisories/GHSA-97r3-5w84-r4q8 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pyload-ng project pyload-ng | < 0.5.0b3.dev100 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |