CVE-2026-123815

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev102

Description The UnTar. safe extractall function in src/pyload/plugins/extractors/UnTar.py fails to call TarInfo.isdev to reject special tar member types before executing tarfile.extractall. On Python 3.9 through 3.13 runtimes, which default to a fully trusted extraction filter, a user with ADD and STATUS permissions can upload a crafted archive to create character devices, block devices, or FIFOs (First-In-First-Out, a type of pipe used for inter-process communication). If the application runs with privileges that allow device creation, such as the root-based Docker deployment, this can expose raw devices and compromise the host. In non-root deployments, the creation of FIFOs can lead to system hangs or IPC confusion.

Recommendations Update to version 0.5.0b3.dev102.