CVE-2026-42314CWE-22

pyLoad: Path Traversal via Package Folder Name

Medium · published May 11, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.dev100.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00423 · 35.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-11T16:34Z
EPSS history
Timeline
  • 11 MAY 16:34Z
    pyLoad: Path Traversal via Package Folder Name
    cvelistv5