GHSA-6px9-j4qr-xfjw

Suggest an improvement
Source
https://github.com/advisories/GHSA-6px9-j4qr-xfjw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6px9-j4qr-xfjw/GHSA-6px9-j4qr-xfjw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6px9-j4qr-xfjw
Aliases
Published
2026-03-05T00:32:19Z
Modified
2026-06-08T19:15:12Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
Summary
pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
Details

The edit_package() function implements insufficient sanitization for the pack_folder parameter. The current protection relies on a single-pass string replacement of "../", which can be bypassed using crafted recursive traversal sequences.

Exploitation

An authenticated user with MODIFY permission can bypass the sanitization by submitting a payload such as: pack_folder=..././..././..././tmp

After the single-pass replacement, this becomes: ../../../tmp

Because the traversal sequences are not properly validated, the resulting normalized path escapes the intended storage directory and writes files to /tmp or other locations.

Database specific 
{
    "cwe_ids":  [
        "CWE-23"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-05T00:32:19Z",
    "nvd_published_at":  "2026-03-07T16:15:54Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / pyload-ng

Package

Name
pyload-ng
View open source insights on deps.dev
Purl
pkg:pypi/pyload-ng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.5.0b3.dev13
Fixed
0.5.0b3.dev97

Affected versions

0.*
0.5.0b3.dev13
0.5.0b3.dev14
0.5.0b3.dev17
0.5.0b3.dev18
0.5.0b3.dev19
0.5.0b3.dev20
0.5.0b3.dev21
0.5.0b3.dev22
0.5.0b3.dev24
0.5.0b3.dev26
0.5.0b3.dev27
0.5.0b3.dev28
0.5.0b3.dev29
0.5.0b3.dev30
0.5.0b3.dev31
0.5.0b3.dev32
0.5.0b3.dev33
0.5.0b3.dev34
0.5.0b3.dev35
0.5.0b3.dev38
0.5.0b3.dev39
0.5.0b3.dev40
0.5.0b3.dev41
0.5.0b3.dev42
0.5.0b3.dev43
0.5.0b3.dev44
0.5.0b3.dev45
0.5.0b3.dev46
0.5.0b3.dev47
0.5.0b3.dev48
0.5.0b3.dev49
0.5.0b3.dev50
0.5.0b3.dev51
0.5.0b3.dev52
0.5.0b3.dev53
0.5.0b3.dev54
0.5.0b3.dev57
0.5.0b3.dev60
0.5.0b3.dev62
0.5.0b3.dev64
0.5.0b3.dev65
0.5.0b3.dev66
0.5.0b3.dev67
0.5.0b3.dev68
0.5.0b3.dev69
0.5.0b3.dev70
0.5.0b3.dev71
0.5.0b3.dev72
0.5.0b3.dev73
0.5.0b3.dev74
0.5.0b3.dev75
0.5.0b3.dev76
0.5.0b3.dev77
0.5.0b3.dev78
0.5.0b3.dev79
0.5.0b3.dev80
0.5.0b3.dev81
0.5.0b3.dev82
0.5.0b3.dev85
0.5.0b3.dev87
0.5.0b3.dev88
0.5.0b3.dev89
0.5.0b3.dev90
0.5.0b3.dev91
0.5.0b3.dev92
0.5.0b3.dev93
0.5.0b3.dev94
0.5.0b3.dev95
0.5.0b3.dev96

Database specific

last_known_affected_version_range 
"<= 0.5.0b3.dev96"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6px9-j4qr-xfjw/GHSA-6px9-j4qr-xfjw.json"