CVE-2025-54140: pyLoad Path Traversal Vulnerability

CVE-2025-54140 Overview

CVE-2025-54140 is a path traversal vulnerability affecting pyLoad, a free and open-source Download Manager written in pure Python. The vulnerability exists in version 0.5.0b3.dev89 within the /json/upload endpoint, allowing authenticated attackers to manipulate uploaded file names to write arbitrary files outside the intended upload directory.

Critical Impact

Authenticated attackers can achieve Remote Code Execution (RCE), local privilege escalation, system-wide compromise, and establish persistent backdoors by writing arbitrary files to any location accessible by the pyLoad process.

Affected Products

• pyLoad version 0.5.0b3.dev89

Discovery Timeline

• 2025-07-22 - CVE-2025-54140 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-54140

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The flaw allows authenticated users to bypass directory restrictions by manipulating filename parameters during file upload operations. When the /json/upload endpoint processes an upload request, it fails to properly sanitize or validate the filename, enabling attackers to include directory traversal sequences such as ../ within the filename.

The vulnerability enables attackers to write files to arbitrary locations on the filesystem where the pyLoad process has write permissions. This capability can be leveraged for multiple attack scenarios including overwriting configuration files, placing malicious scripts in web-accessible directories, or modifying system files to achieve code execution.

Root Cause

The root cause lies in insufficient input validation within the json_blueprint.py file, specifically at the upload handling function around line 109. The application accepts user-supplied filenames without adequately sanitizing path traversal sequences. The fix implemented in version 0.5.0b3.dev90 addresses this by properly validating and restricting file paths to prevent directory escape attempts.

Attack Vector

The attack requires authentication to the pyLoad web interface but operates over the network without user interaction. An authenticated attacker crafts a malicious upload request to the /json/upload endpoint with a filename containing path traversal sequences (e.g., ../../etc/cron.d/malicious). When processed, the application writes the uploaded content to the traversed path rather than the intended upload directory.

The vulnerability can lead to several exploitation scenarios:

• Writing a malicious Python script to pyLoad's plugin directory for code execution
• Overwriting system cron jobs or startup scripts for persistence
• Modifying application configuration files to escalate privileges
• Creating web shells in accessible directories for remote access

For technical implementation details, refer to the vulnerable code location and the security advisory.

Detection Methods for CVE-2025-54140

Indicators of Compromise

• Unexpected files appearing outside the designated pyLoad upload directory
• Files with creation timestamps matching upload activity but located in system directories
• Unauthorized modifications to pyLoad configuration or plugin files
• Suspicious POST requests to /json/upload containing ../ or encoded traversal sequences in parameters

Detection Strategies

• Monitor HTTP request logs for the /json/upload endpoint with filenames containing path traversal patterns (../, ..%2f, ..%252f)
• Implement file integrity monitoring on critical system directories and pyLoad installation paths
• Configure web application firewalls to detect and block path traversal attempts in upload parameters
• Review pyLoad access logs for authenticated users performing unusual upload patterns

Monitoring Recommendations

• Enable verbose logging for the pyLoad web interface to capture detailed request parameters
• Deploy endpoint detection and response (EDR) solutions to monitor file system write operations by the pyLoad process
• Set up alerts for file creation events in directories outside the expected upload path
• Audit authentication logs for compromised accounts that may be used to exploit this vulnerability

How to Mitigate CVE-2025-54140

Immediate Actions Required

• Upgrade pyLoad to version 0.5.0b3.dev90 or later immediately
• Review file system for any unauthorized files that may have been written through exploitation
• Audit authentication logs and revoke sessions for any suspicious accounts
• Temporarily restrict network access to the pyLoad web interface until patching is complete

Patch Information

The vulnerability has been fixed in pyLoad version 0.5.0b3.dev90. The patch can be verified through the GitHub commit. Users should update their installations to this version or later to remediate the vulnerability. Additional details are available in the GitHub Security Advisory (GHSA-xqpg-92fq-grfg).

Workarounds

• Restrict access to the pyLoad web interface to trusted networks or localhost only
• Implement a reverse proxy with strict input validation for upload endpoints
• Run pyLoad with minimal file system permissions to limit the impact of arbitrary file writes
• Disable the upload functionality if not required until the patch can be applied

# Restrict pyLoad to localhost only as a temporary mitigation
# Edit pyLoad configuration to bind only to 127.0.0.1
# Example: Update the bind address in pyLoad settings
# host = 127.0.0.1
# port = 8000