Path Traversal Vulnerability in pyLoad Download Manager Affects Unauthenticated Users

CVE-2025-54802

What is CVE-2025-54802?

A vulnerability in the pyLoad-ng CNL Blueprint enables path traversal due to unsafe path construction in the addcrypted endpoint. This flaw permits unauthorized attackers to write arbitrary files outside intended storage directories. Such exploitation can lead to critical system modifications, like overwriting cron jobs and systemd services, resulting in potential privilege escalation and remote code execution with root privileges. Users are highly encouraged to upgrade to version 0.5.0b3.dev90 or later to mitigate this risk.

References