FKIE_CVE-2026-32808

Vulnerability from fkie_nvd - Published: 2026-03-20 02:16 - Updated: 2026-03-26 18:36
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Summary
pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside of the extraction directory. During password verification, pyLoad derives an archive entry name from 7z listing output and treats it as a filesystem path without constraining it to the extraction directory. This issue has been fixed in version 0.5.0b3.dev97.
References
security-advisories@github.comhttps://github.com/pyload/pyload/security/advisories/GHSA-7g4m-8hx2-4qh3Exploit, Mitigation, Vendor Advisory
Impacted products
Vendor Product Version
pyload pyload *
pyload-ng_project pyload-ng *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DACFA9B5-22AD-4BC6-87D5-8272FF49BD56",
              "versionEndIncluding": "0.4.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:*",
              "matchCriteriaId": "FCF4830F-E848-4F80-AB82-2040E219E677",
              "versionEndExcluding": "0.5.0b3.dev97",
              "versionStartIncluding": "0.5.0a5.dev528",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside of the extraction directory. During password verification, pyLoad derives an archive entry name from 7z listing output and treats it as a filesystem path without constraining it to the extraction directory. This issue has been fixed in version 0.5.0b3.dev97."
    },
    {
      "lang": "es",
      "value": "pyLoad es un gestor de descargas gratuito y de c\u00f3digo abierto escrito en Python. Las versiones anteriores a 0.5.0b3.dev97 son vulnerables a salto de ruta durante la verificaci\u00f3n de contrase\u00f1a de ciertos archivos 7z cifrados (archivos cifrados con encabezados no cifrados), causando la eliminaci\u00f3n arbitraria de archivos fuera del directorio de extracci\u00f3n. Durante la verificaci\u00f3n de contrase\u00f1a, pyLoad deriva un nombre de entrada de archivo de la salida de listado de 7z y lo trata como una ruta del sistema de archivos sin restringirlo al directorio de extracci\u00f3n. Este problema ha sido corregido en la versi\u00f3n 0.5.0b3.dev97."
    }
  ],
  "id": "CVE-2026-32808",
  "lastModified": "2026-03-26T18:36:48.053",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-20T02:16:34.683",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-7g4m-8hx2-4qh3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.