CVE-2026-42314

EUVD-2026-29122
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.dev100.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Affected Products (NVD)
VendorProductVersion
pyload-ng_projectpyload-ng
𝑥
< 0.5.0b3.dev100
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/pyload/pyload/security/advisories/GHSA-97r3-5w84-r4q8
https://github.com/pyload/pyload/security/advisories/GHSA-97r3-5w84-r4q8