CVE-2026-42314: Pyload-ng Path Traversal Vulnerability

CVE-2026-42314 Overview

pyLoad is a free and open-source download manager written in Python. CVE-2026-42314 is a path traversal vulnerability [CWE-22] in pyLoad versions prior to 0.5.0b3.dev100. The flaw resides in the package folder name sanitization routine, which uses insufficient string replacement to neutralize directory traversal sequences. The pattern ....// is reduced to .._ through partial removal, leaving a residual .. sequence that the operating system later resolves during path construction. Authenticated attackers can leverage this to write files outside the intended package directory. The maintainers fixed the issue in 0.5.0b3.dev100.

Critical Impact
Authenticated attackers can manipulate package folder names to traverse the file system and write files outside the intended directory, compromising integrity of pyLoad host systems.

Affected Products

pyLoad (pyload-ng) versions prior to 0.5.0b3.dev100
Python-based deployments of pyload-ng from the pyload-ng_project
Self-hosted pyLoad download manager instances

Discovery Timeline

2026-05-11 - CVE-2026-42314 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-42314

Vulnerability Analysis

The vulnerability stems from a flawed sanitization routine applied to package folder names in pyLoad. The code attempts to strip directory traversal sequences using string replacement, but the replacement is non-recursive and pattern-incomplete. When an attacker supplies the sequence ....//, the sanitizer removes the inner ..// portion and produces .._. The remaining .. is preserved verbatim in the resulting folder name string.

When pyLoad subsequently passes this sanitized string to filesystem APIs, the operating system resolves .. as a parent directory reference. This breaks containment of the package directory and allows the attacker-controlled path component to traverse upward. The defect maps to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Exploitation requires low privileges and no user interaction, with impact concentrated on file system integrity. Confidentiality and availability are not directly affected by the primary impact vector.

Root Cause

The root cause is the use of single-pass string replacement to enforce a security boundary. Sanitization routines that remove substrings without iterating until a fixed point are vulnerable to overlapping pattern attacks. The pyLoad code does not validate the final resolved path against the intended base directory after sanitization.

Attack Vector

The attack is network-reachable and requires an authenticated session with privileges to create or rename packages. The attacker submits a package name containing crafted traversal sequences such as ....//. After sanitization, the residual .. traverses parent directories when the package folder is created on disk. See the GitHub Security Advisory GHSA-97r3-5w84-r4q8 for additional technical context.

// No verified proof-of-concept code is publicly available.
// Refer to the vendor advisory for technical detail.

Detection Methods for CVE-2026-42314

Indicators of Compromise

Package folder names on disk containing residual .. sequences or unexpected parent directory references
Files created by the pyLoad process outside the configured download or package root directory
Audit log entries showing package creation or rename requests with payloads containing ....// or similar overlapping traversal patterns

Detection Strategies

Inspect pyLoad HTTP request logs for package management endpoints carrying traversal patterns such as ....//, ....\\, or repeated dot sequences
Monitor the pyLoad service for file write operations targeting paths outside the configured base directory
Compare the running pyload-ng version against 0.5.0b3.dev100 to identify unpatched deployments

Monitoring Recommendations

Enable verbose logging on pyLoad package creation and rename actions and forward logs to a centralized SIEM
Apply file integrity monitoring to directories adjacent to the pyLoad installation and download paths
Alert on authenticated API calls from unusual source addresses interacting with pyLoad package management routes

How to Mitigate CVE-2026-42314

Immediate Actions Required

Upgrade pyload-ng to version 0.5.0b3.dev100 or later without delay
Audit existing package directories for unexpected paths containing .. components and remove any anomalous folders
Rotate credentials for pyLoad accounts and restrict access to trusted operators only

Patch Information

The maintainers fixed CVE-2026-42314 in pyload-ng version 0.5.0b3.dev100. The patched release replaces the partial string replacement with a sanitization routine that prevents residual traversal sequences. Refer to the pyLoad GitHub Security Advisory for release notes and upgrade guidance.

Workarounds

Restrict network access to the pyLoad web interface using firewall rules or a reverse proxy with IP allow-listing
Run pyLoad as a low-privileged user inside a container or chroot to limit the blast radius of any traversal write
Disable package creation by untrusted authenticated users until the upgrade can be deployed

bash

# Upgrade pyload-ng to the patched release
pip install --upgrade 'pyload-ng>=0.5.0b3.dev100'

# Verify the installed version
pip show pyload-ng | grep -i version