CVE-2025-54140: pyLoad Path Traversal Vulnerability in json/upload Endpoint
Summary
CVE-2025-54140: pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write. Affects pyload-ng versions >= 0.5.0b3.dev89, < 0.5.0b3.dev90. Fixed in 0.5.0b3.dev90. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyLoad is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It supports multiple protocols and provides a web interface for easy access. However, a critical vulnerability has been identified in the json/upload endpoint, which can be exploited to perform unauthorized file operations on the server.
Vulnerability Detail
An authenticated path traversal vulnerability exists in the /json/upload endpoint of pyLoad. By manipulating the filename of an uploaded file, an attacker can traverse out of the intended upload directory, allowing them to write arbitrary files to any location on the system accessible to the pyLoad process. This vulnerability can lead to severe consequences, including remote code execution, local privilege escalation, system-wide compromise, and the establishment of persistence mechanisms such as backdoors.
How To Fix
Latest published version: 0.5.0b3.dev101 as of 23 Oct 2026
pip install --upgrade "pyload-ng==0.5.0b3.dev101"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0b3.dev90
This is the first release that contains the fix.
pip install --upgrade "pyload-ng==0.5.0b3.dev90"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict file uploads by implementing filename validation and sanitization in your application code. For example, modify the upload function to check for invalid characters in the filename before saving the file. Here is a sample code snippet:
import re
@json_blueprint.route("/upload", methods=["POST"])
def upload():
dir_path = api.get_config_value("general", "storage_folder")
for file in request.files.getlist("file"):
if re.search(r'[^a-zA-Z0-9_.-]', file.filename):
return "Invalid filename", 400
file_path = os.path.join(dir_path, "tmp_" + file.filename)
file.save(file_path)
Conclusion
The CVE-2025-54140 vulnerability in pyLoad poses a significant risk due to its potential for exploitation through path traversal. Users are strongly advised to update to the latest version to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2025-54140 is a path traversal vulnerability in the pyLoad download manager that allows attackers to write arbitrary files to the server.
An attacker can exploit this vulnerability by uploading a file with a manipulated filename that includes path traversal sequences, allowing them to save files outside the intended directory.
The impacts include remote code execution, local privilege escalation, system-wide compromise, and the ability to install backdoors.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
If immediate updates are not possible, implement filename validation and sanitization as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
