CVE-2026-42315

Summary (CVE-2026-42315) pyLoad before 0.5.0b3.dev100 is vulnerable to path traversal via the _folder field in set_package_data, allowing a user with Perms.MODIFY to set arbitrary download folders. The root cause is lack of sanitization for folder names supplied to set_package_data(), enabling ab...

CVE-2026-42314 pyLoad: Path Traversal via Package Folder Name

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .. after replacement partial removal, leaving .. which can be exploited when the path is later resolve...

GHSA-97R3-5W84-R4Q8 PyLoad Vulnerable to Path Traversal via Package Folder Name

Insufficient sanitization of package folder names allows writing files outside the intended download directory. Affected Component - src/pyload/core/api/init.py - Function: addpackage Description Package folder names are sanitized using insufficient string replacement: python folder =...