Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pyload-ng | pip | <= 0.5.0b3.dev89 | 0.5.0b3.dev90 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the addcrypted function in src/pyload/webui/app/blueprints/cnl_blueprint.py. The function takes a package parameter from a POST request and uses it to construct a file path for a .dlc file. The initial implementation had insufficient input sanitization, only removing slashes and colons, but failing to prevent path traversal sequences like ../. This allowed an unauthenticated attacker to craft a package parameter that, when combined with os.path.join, results in a path outside of the intended download directory. The attacker could then write arbitrary content to this path. The provided PoC demonstrates this by writing a cron job to /etc/cron.d/, leading to remote code execution. The patch introduces a check to verify that the final, normalized path is within the designated storage folder, thus preventing the path traversal.
