CVEvulnerability

CVE-2026-32808

8.1 HIGH Published 2026-03-20 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-03-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weaknesses
CWE-22

Description

pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside of the extraction directory. During password verification, pyLoad derives an archive entry name from 7z listing output and treats it as a filesystem path without constraining it to the extraction directory. This issue has been fixed in version 0.5.0b3.dev97.

Affected configurations

• pyload pyload (<= 0.4.20) • pyload-ng project pyload-ng (>= 0.5.0a5.dev528 < 0.5.0b3.dev97)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References