CVE-2026-29778
published 2026-03-07CVE-2026-29778: pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements…
PriorityP340medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.52%
40.0th percentile
pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insufficient sanitization for the pack_folder parameter. The current protection relies on a single-pass string replacement of "../", which can be bypassed using crafted recursive traversal sequences. This issue has been patched in version 0.5.0b3.dev97.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pyload-ng_project | pyload-ng | >= 0.5.0b3.dev13 < 0.5.0b3.dev97 | 0.5.0b3.dev97 |
| pyload-ng_project | pyload-ng | 0.5.0b3.dev13 – 0.5.0b3.dev96 | — |
| pyload | pyload | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
ghsa·2026-03-05
CVE-2026-29778 [HIGH] CWE-23 pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
The edit_package() function implements insufficient sanitization for the pack_folder parameter. The current protection relies on a single-pass string replacement of "../", which can be bypassed using crafted recursive traversal sequences.
Exploitation
An authenticated user with MODIFY permission can bypass the sanitization by submitting a payload such as:
`pack_folder=..././..././..././tmp`
After the single-pass replacement, this becomes:
`../../../tmp`
Because the traversal sequences are not properly validated, the resulting normalized path escapes the intended storage directory and writes files to /tmp or other locations.
OSV
pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
osv·2026-03-05
CVE-2026-29778 [HIGH] pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
The edit_package() function implements insufficient sanitization for the pack_folder parameter. The current protection relies on a single-pass string replacement of "../", which can be bypassed using crafted recursive traversal sequences.
Exploitation
An authenticated user with MODIFY permission can bypass the sanitization by submitting a payload such as:
`pack_folder=..././..././..././tmp`
After the single-pass replacement, this becomes:
`../../../tmp`
Because the traversal sequences are not properly validated, the resulting normalized path escapes the intended storage directory and writes files to /tmp or other locations.
No detection rules found.
No public exploits indexed.
2026-03-07
Published