CVE-2026-29778: pyLoad: Arbitrary File Write via Path Traversal in edit_package()
pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the editpackage() function implements insufficient sanitization for the packfolder parameter. The current protection relies on a single-pass string replacement of "../", which can be bypassed using crafted recursive traversal sequences. This issue has been patched in version 0.5.0b3.dev97.
Other sources
The editpackage() function implements insufficient sanitization for the packfolder parameter. The current protection relies on a single-pass string replacement of "../", which can be bypassed using crafted recursive traversal sequences.
Exploitation
An authenticated user with MODIFY permission can bypass the sanitization by submitting a payload such as: packfolder=..././..././..././tmp
After the single-pass replacement, this becomes: ../../../tmp
Because the traversal sequences are not properly validated, the resulting normalized path escapes the intended storage directory and writes files to /tmp or other locations.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29778?
CVE-2026-29778 is rated as a high-severity vulnerability due to its potential for arbitrary file writes.
How do I fix CVE-2026-29778?
To fix CVE-2026-29778, upgrade pyLoad to a version later than 0.5.0b3.dev96 where the issue has been addressed.
What causes CVE-2026-29778?
CVE-2026-29778 is caused by insufficient sanitization of the pack_folder parameter in the edit_package() function.
Which versions of pyLoad are affected by CVE-2026-29778?
CVE-2026-29778 affects pyLoad versions from 0.5.0b3.dev13 to 0.5.0b3.dev96.
What is the potential impact of exploiting CVE-2026-29778?
Exploiting CVE-2026-29778 can allow an attacker to write arbitrary files on the system, leading to potential data breaches or system compromise.