CVE-2026-42315 Overview
CVE-2026-42315 is a path traversal vulnerability [CWE-22] in pyLoad, a free and open-source download manager written in Python. The flaw exists in the set_package_data() API function, which fails to sanitize the _folder key passed inside the data object. An authenticated user with Perms.MODIFY privileges can specify arbitrary directories as download locations for a package. The issue affects pyLoad releases prior to 0.5.0b3.dev100 and is fixed in that version.
Critical Impact
Authenticated attackers with modify permissions can redirect downloads to arbitrary filesystem paths, enabling file writes outside the intended download directory and potential integrity compromise of the host system.
Affected Products
- pyLoad (pyload-ng) versions prior to 0.5.0b3.dev100
- Python-based pyload-ng package distributions
- Self-hosted pyLoad download manager instances
Discovery Timeline
- 2026-05-11 - CVE-2026-42315 published to NVD
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-42315
Vulnerability Analysis
The vulnerability resides in the pyLoad API endpoint exposed through set_package_data(). When the API receives a data object, the implementation reads the _folder key and applies it as the download destination for the specified package. The function performs no validation or canonicalization on the supplied value. An attacker with the Perms.MODIFY role can submit traversal sequences or absolute paths, causing pyLoad to write downloaded content into locations outside the configured download directory. Because the underlying file write inherits the privileges of the pyLoad process, the attacker can target directories such as web roots, configuration directories, or systemd unit paths reachable to that user account.
Root Cause
The root cause is missing input sanitization on a user-controlled path field. The advisory notes there is no sanitization at all on the _folder value passed to set_package_data(). The code accepts the string as-is and uses it directly as a directory reference, violating standard path normalization and allow-list validation practices required for any filesystem-bound parameter [CWE-22].
Attack Vector
Exploitation requires network access to the pyLoad web API and an authenticated account holding Perms.MODIFY. The attacker issues an authenticated API call to set_package_data() with a crafted _folder value such as a relative path containing ../ sequences or an absolute path. Subsequent downloads tied to the package are written to the attacker-chosen directory. The vulnerability does not provide direct read access to confidential data, but it does allow integrity-impacting file placement on the host.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-838g-gr43-qqg9 for technical details.
Detection Methods for CVE-2026-42315
Indicators of Compromise
- API requests to set_package_data() containing a _folder value with ../ sequences, absolute paths, or paths outside the configured pyLoad download directory.
- Files appearing in unexpected directories owned by the pyLoad service account, particularly in web roots, configuration folders, or user home directories.
- pyLoad package records whose stored folder attribute does not match the deployment's configured download root.
Detection Strategies
- Enable verbose API logging on pyLoad and parse logs for set_package_data calls, alerting on any _folder value containing traversal characters or non-allow-listed paths.
- Apply file integrity monitoring on directories adjacent to the pyLoad download root to flag new writes attributable to the pyLoad process.
- Correlate authenticated session activity from Perms.MODIFY accounts with subsequent filesystem write events to detect suspicious package reconfiguration.
Monitoring Recommendations
- Forward pyLoad application logs and host filesystem audit events to a centralized log platform for retention and correlation.
- Monitor outbound HTTP requests originating from the pyLoad service account, since attacker-controlled downloads may target second-stage payloads.
- Track authentication events for pyLoad accounts with elevated permissions and alert on logins from unusual IP ranges or user agents.
How to Mitigate CVE-2026-42315
Immediate Actions Required
- Upgrade pyLoad to version 0.5.0b3.dev100 or later, where input sanitization on the _folder parameter is enforced.
- Audit existing pyLoad packages and remove any whose download folder points outside the intended download root.
- Review accounts holding Perms.MODIFY and revoke the permission from users who do not require package configuration access.
Patch Information
The maintainers fixed the issue in pyLoad 0.5.0b3.dev100. Refer to the pyLoad GitHub Security Advisory GHSA-838g-gr43-qqg9 for the patch reference and upgrade instructions.
Workarounds
- Restrict network access to the pyLoad web interface using a reverse proxy or firewall, exposing it only to trusted administrative networks.
- Run pyLoad under a dedicated unprivileged user account with filesystem permissions limited to the intended download directory.
- Enforce strong authentication and rotate credentials for any account granted Perms.MODIFY until the upgrade is applied.
# Upgrade pyload-ng to the patched release
pip install --upgrade 'pyload-ng>=0.5.0b3.dev100'
# Verify installed version
pip show pyload-ng | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
