CVE-2026-42314

6.5 Moyenne

Publiée le 11/05/2026 à 20:16 · Modifiée le 17/06/2026 à 12:47 · Analysée par le NVD · Source : security-advisories@github.com

Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.dev100.

Traduire en français

Produits concernés

pyload
Pyload-ng project pyload-ng

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-22

Références

https://github.com/pyload/pyload/security/advisories/GHSA-97r3-5w84-r4q8 ExploitVendor Advisory
https://github.com/pyload/pyload/security/advisories/GHSA-97r3-5w84-r4q8 ExploitVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories