Security Flaw in pyLoad Download Manager Affects Archive Extraction
CVE-2026-123815

9.4CRITICAL

Key Information:

Vendor

Pyload

Status
Pyload
Vendor
CVE Published:
9 November 2026

What is CVE-2026-123815?

A vulnerability in pyLoad, an open-source download manager, allows specially crafted archive files to be exploited during extraction due to improper validation of archive member paths and types. Specifically, the function UnTar._safe_extractall fails to reject special tar member types, which can lead to the extraction of sensitive character devices, block devices, or FIFOs on systems with elevated privileges. This issue affects supported versions from Python 3.9 to 3.13, where the default extraction filter allows unsafe operations. Users running pyLoad with root privileges, particularly in Docker environments, may inadvertently expose raw devices, posing a significant risk to system integrity. Non-root instances can still create FIFOs, leading to system hangs or inter-process communication issues. The vulnerability is addressed in pyLoad version 0.5.0b3.dev102.

Affected Version(s)

pyload < 0.5.0b3.dev102

References

https://github.com/pyload/pyload/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/pyload/pyload/commit/09eec1b431b6942a1...
x_refsource_MISC

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.