CVE-2026-42314

pyLoad: Path Traversal via Package Folder Name

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.dev100.

Affected

pyload

CVSS v3.1 GITHUB

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2026-05-11

Proof-of-concept exploits (1)

• advisories/GHSA-97r3-5w84-r4q8

Security advisories

• pyload/pyload/security/advisories/GHSA-97r3-5w84-r4q8

References

• CVE Record
• NVD entry