Path Traversal Vulnerability in gdown by Google

CVE-2026-40491

What is CVE-2026-40491?

The gdown tool, a Google Drive downloader, has a vulnerability that allows attackers to exploit the extractall functionality through a Path Traversal attack. When handling specially crafted ZIP or TAR files, gdown does not properly sanitize the filenames of the included files. As a result, this flaw permits unauthorized file writes outside the intended extraction directory. This could lead to significant security risks, including arbitrary file overwrites and potential Remote Code Execution (RCE). Users are advised to upgrade to version 5.2.2 or later, which addresses this issue.

References