Insufficient Sanitization Flaw in pyLoad Download Manager by pyLoad
CVE-2026-29778

7.1HIGH

Key Information:

Vendor

Pyload

Status
Pyload
Vendor
CVE Published:
7 March 2026

What is CVE-2026-29778?

A vulnerability exists in the pyLoad download manager, specifically in the edit_package() function, allowing attackers to exploit inadequate sanitization of the pack_folder parameter. The flawed implementation utilizes a single-pass string replacement for the "../" sequence, which can be easily circumvented using crafted recursive traversal sequences. This security flaw could lead to unauthorized access to file paths outside the intended directories. The issue has been resolved in version 0.5.0b3.dev97, so users are encouraged to update promptly.

Affected Version(s)

pyload >= 0.5.0b3.dev13, < 0.5.0b3.dev97

References

https://github.com/pyload/pyload/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.