CVE-2026-42315
HighSummary
In pyLoad prior to version 0.5.0b3.dev100, there is a vulnerability that allows a user with Perms.MODIFY to specify arbitrary directories as download locations for a package through the set_package_data() API function. The lack of sanitization in the '_folder' key enables this action.
Risk Assessment
The organization may be exposed to unauthorized file downloads to unsafe locations, potentially leading to data loss or malware.
Recommendation
It is recommended to update pyLoad to version 0.5.0b3.dev100 or later to mitigate this vulnerability.
Other vulnerabilities in pyLoad
See all- CVE-2026-42313High
In pyLoad prior to version 0.5.0b3.dev100, the set_config_value() API method improperly managed security-sensitive options, allowing authenticated users with SETTINGS permission to enable proxying and route traffic through a host they control.
- CVE-2026-35459Critical
pyLoad in version 0.5.0b3.dev96 and earlier has an SSRF vulnerability. The fix for CVE-2026-33992 added IP validation, but pycurl automatically follows HTTP redirects and redirect targets are not validated. An authenticated user with ADD permission can bypass the SSRF filter by using a URL that redirects to an internal address.
- CVE-2026-35187High
In pyLoad 0.5.0b3.dev96 and earlier, the parse_urls API function fetches arbitrary URLs server-side without validation. An authenticated user with ADD permission can read internal resources, local files (file://), and use gopher:// and dict:// protocols.
- CVE-2023-47890High
pyLoad 0.5.0 is vulnerable to unrestricted file upload, allowing an attacker to upload arbitrary files to the server without proper validation.
Original NVD description (English source)
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all, allowing a user with Perms.MODIFY to specify arbitrary directories as download locations for a package. This vulnerability is fixed in 0.5.0b3.dev100.