CVE-2026-29778

HIGH SEVERITY

CVSS Score & Metrics

Base Score

7.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L                                    

Vulnerability Description

pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insufficient sanitization for the pack_folder parameter. The current protection relies on a single-pass string replacement of "../", which can be bypassed using crafted recursive traversal sequences. This issue has been patched in version 0.5.0b3.dev97.

Vulnerability Details

Published Date

March 05, 2026

Last Modified

March 11, 2026

CWE ID

CWE-23

Source

GitHub

Vendor

pip

Product

pyload-ng

External References

https://github.com/pyload/pyload/security/advisories/GHSA-6px9-j4qr-xfjw
https://github.com/advisories/GHSA-6px9-j4qr-xfjw

CVE-2026-29778

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment