6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42314

CVE-2026-42314: pyLoad: Path Traversal via Package Folder Name

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.dev100.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42314

CVE-2026-42314:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pyload-ng	pip	<= 0.5.0b3.dev79	0.5.0b3.dev100

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis identified two vulnerable functions in src/pyload/core/api/__init__.py that contribute to a path traversal vulnerability. The root cause is insufficient sanitization of the package folder name.

Api.add_package: As per the vulnerability description, this function was initially vulnerable. It used a flawed string replacement logic to sanitize the folder name derived from the package name. This weak sanitization could be bypassed, allowing the creation of packages with folder paths that traverse the directory structure.
Api.set_package_data: This function, highlighted by the proof-of-concept, provides a way to change a package's folder name after its creation. The vulnerability lies in the function's failure to sanitize the folder attribute when new data is submitted. The code only sanitizes a private _folder attribute, leaving the public folder attribute exposed. An authenticated attacker can exploit this to set a malicious folder path, causing files to be written outside the designated download directory during the download process.

The exploit path involves an authenticated user first creating a package (via add_package) and then using set_package_data to inject the path traversal payload into the package's folder name. When pyLoad processes the download for this package, it combines the download directory with the malicious folder name, and the operating system resolves the .. sequences, leading to the file being written to an unintended location.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.