CVE-2026-29778: Pyload-ng Path Traversal Vulnerability

CVE-2026-29778 Overview

CVE-2026-29778 is a path traversal vulnerability affecting pyLoad, a free and open-source download manager written in Python. The vulnerability exists in the edit_package() function, which implements insufficient sanitization for the pack_folder parameter. The current protection mechanism relies on a single-pass string replacement of "../", which can be bypassed using crafted recursive traversal sequences such as "....//". This allows authenticated attackers to manipulate file paths and potentially write files to arbitrary locations on the server.

Critical Impact
Authenticated attackers can bypass path sanitization to write files outside the intended download directory, potentially leading to configuration overwrite, code injection, or system compromise.

Affected Products

pyload-ng versions 0.5.0b3.dev13 through 0.5.0b3.dev96
pyload-ng for Python environments
Systems running vulnerable pyLoad instances with network exposure

Discovery Timeline

2026-03-07 - CVE CVE-2026-29778 published to NVD
2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-29778

Vulnerability Analysis

This path traversal vulnerability (CWE-23) stems from an inadequate input validation mechanism in pyLoad's package editing functionality. The edit_package() function attempts to prevent directory traversal attacks by replacing "../" sequences in the pack_folder parameter. However, this single-pass replacement approach is fundamentally flawed and can be trivially bypassed.

When an attacker supplies a crafted path such as "....//", the replacement function removes the inner "../" sequence, but the remaining characters combine to form a new "../" sequence after the replacement completes. This allows an authenticated user to escape the designated download directory and potentially write files to arbitrary locations on the filesystem.

The vulnerability requires low-privilege authentication to exploit, meaning any user with access to the pyLoad web interface can potentially leverage this flaw. Since pyLoad runs with the permissions of its host user, successful exploitation could enable writing malicious files to sensitive system locations.

Root Cause

The root cause is the implementation of a single-pass string replacement for path traversal prevention instead of a recursive or iterative sanitization approach. The protection logic only processes the input once, failing to account for nested or recursive traversal sequences that reconstruct themselves after the initial sanitization pass. Proper input validation should either use iterative sanitization until no traversal sequences remain, or employ path canonicalization to resolve the absolute path before validation.

Attack Vector

The attack is conducted over the network by an authenticated user. An attacker with valid credentials to the pyLoad web interface can modify the pack_folder parameter when editing package configurations. By submitting a specially crafted path containing recursive traversal sequences like "....//", the attacker can escape the intended download directory structure. This could allow writing downloaded files to arbitrary filesystem locations, potentially overwriting configuration files, placing malicious scripts in executable directories, or modifying application code.

The vulnerability does not require user interaction beyond the attacker's own authentication and manipulation of the package editing request. The impact is primarily to system integrity, as attackers can manipulate file locations on the server.

Detection Methods for CVE-2026-29778

Indicators of Compromise

Unusual file paths containing recursive traversal patterns (e.g., "....//", "..../", or similar variations) in pyLoad logs
Downloaded files appearing in unexpected directories outside the configured download path
Modifications to system configuration files or application code that correlate with pyLoad activity
Web server access logs showing suspicious requests to the package editing endpoint with encoded traversal sequences

Detection Strategies

Monitor pyLoad application logs for package edit operations containing suspicious path patterns
Implement web application firewall (WAF) rules to detect and block recursive path traversal attempts in request parameters
Deploy file integrity monitoring (FIM) on critical system directories to detect unauthorized file creation or modification
Review pyLoad audit logs for unusual package folder configurations that reference parent directories

Monitoring Recommendations

Enable verbose logging in pyLoad to capture all package edit operations and their parameters
Configure alerting for any file operations occurring outside the designated download directory tree
Implement network monitoring to detect anomalous POST requests to pyLoad's package editing endpoints
Regularly audit the pyLoad installation directory and download paths for unexpected files or modifications

How to Mitigate CVE-2026-29778

Immediate Actions Required

Upgrade pyload-ng to version 0.5.0b3.dev97 or later immediately
Restrict network access to the pyLoad web interface to trusted networks only
Review and revoke access for any unnecessary or suspicious user accounts
Audit recent package edit operations to identify potential exploitation attempts

Patch Information

The vulnerability has been patched in pyload-ng version 0.5.0b3.dev97. Users should upgrade to this version or later to remediate the vulnerability. The patch implements proper sanitization that recursively removes path traversal sequences until the input is fully sanitized.

For detailed information about the vulnerability and patch, refer to the GitHub Security Advisory GHSA-6px9-j4qr-xfjw.

Workarounds

Place the pyLoad web interface behind a reverse proxy with strict access controls and request filtering
Implement network segmentation to limit access to the pyLoad server to authorized administrators only
Configure pyLoad to run with minimal filesystem permissions, restricting write access to only the necessary download directory
Use a containerized deployment to isolate pyLoad and limit the impact of any successful path traversal exploitation

If immediate patching is not possible, consider temporarily disabling the pyLoad web interface or restricting it to localhost-only access until the upgrade can be performed.