CVE-2025-54802: pyload-ng Path Traversal Vulnerability Leading to Remote Code Execution
Summary
CVE-2025-54802: Path Traversal in pyLoad-ng CNL Blueprint via package parameter allows Arbitrary File Write leading to Remote Code Execution (RCE) The addcrypted endpoint in pyload-ng suffers from an unsafe path construction vulnerabili... Affects pyload-ng versions < 0.5.0b3.dev90. Fixed in 0.5.0b3.dev90. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyload-ng is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It is designed to support a wide range of file hosting services and offers features such as link encryption and automatic extraction of archives. However, a critical vulnerability has been identified in the CNL Blueprint of pyload-ng, which exposes the application to path traversal attacks, allowing unauthorized file writes.
Vulnerability Detail
The vulnerability arises from an unsafe path construction in the 'addcrypted' endpoint of pyload-ng. Specifically, the 'package' parameter can be manipulated to traverse the file system, enabling attackers to write arbitrary files outside the intended storage directory. This flaw can lead to severe consequences, including the ability to overwrite critical system files, such as cron jobs and systemd services, resulting in remote code execution with root privileges. The vulnerable code is located in 'src/pyload/webui/app/blueprints/cnl_blueprint.py'.
How To Fix
Latest published version: 0.5.0b3.dev101 as of 23 Oct 2026
pip install --upgrade "pyload-ng==0.5.0b3.dev101"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0b3.dev90
This is the first release that contains the fix.
pip install --upgrade "pyload-ng==0.5.0b3.dev90"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the 'addcrypted' endpoint by implementing authentication mechanisms or by disabling the endpoint until the package is updated. Additionally, ensure that the application runs with the least privileges necessary to limit the impact of potential exploits.
Conclusion
The path traversal vulnerability in pyload-ng (CVE-2025-54802) poses a significant risk, allowing unauthorized file writes and remote code execution. Users are strongly advised to update to the patched version to secure their applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2025-54802 is a critical vulnerability in pyload-ng that allows path traversal, enabling unauthorized file writes and potential remote code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your Pipfile.lock, Vulert can alert you in real-time. You can also use the Vulert playground to check for vulnerabilities without signup.
If exploited, this vulnerability can allow attackers to execute arbitrary code on the server, potentially leading to a full system compromise.
Yes, the vulnerability has been patched in version 0.5.0b3.dev90 of pyload-ng. It is recommended to update to this version or later.
If immediate updating is not possible, implement access controls to the affected endpoint and run the application with minimal privileges to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
