CVE-2026-29778: pyLoad Arbitrary File Write via Path Traversal in edit_package()
Summary
CVE-2026-29778: pyLoad has an Arbitrary File Write via Path Traversal in edit_package(). Affects pyload-ng versions >= 0.5.0b3.dev13, <= 0.5.0b3.dev96. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyLoad is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It is designed to handle multiple file types and offers features such as link extraction, automatic unpacking, and support for various download protocols. However, a vulnerability has been identified in the edit_package() function, which can lead to arbitrary file writes due to insufficient input sanitization.
Vulnerability Detail
The vulnerability arises from the edit_package() function's inadequate sanitization of the 'pack_folder' parameter. The function attempts to prevent directory traversal attacks by replacing instances of '../' with a single-pass string replacement. However, this approach can be bypassed using crafted recursive traversal sequences. For example, an authenticated user with MODIFY permission can exploit this vulnerability by submitting a payload like 'pack_folder=..././..././..././tmp'. After processing, this input becomes '../..../tmp', allowing the attacker to write files outside the intended storage directory, potentially compromising system integrity and confidentiality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the edit_package() function to only trusted users and ensure that proper file permissions are set on the server to mitigate the risk of unauthorized file writes.
Conclusion
The CVE-2026-29778 vulnerability in the pyLoad package poses a significant risk due to its potential for arbitrary file writes. Users are strongly encouraged to update to the latest version of pyload-ng to mitigate this risk. Additionally, implementing temporary workarounds can help protect systems until a full update can be applied.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2026-29778 is a vulnerability in the pyLoad download manager that allows for arbitrary file writes due to path traversal in the edit_package() function.
Any user of the pyload-ng package versions between 0.5.0b3.dev13 and 0.5.0b3.dev96 who has MODIFY permissions is potentially affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
If an immediate update is not possible, consider restricting access to the affected function and reviewing file permissions to minimize risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
