CVE-2026-42314

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev100

Description Insufficient sanitization of package folder names allows writing files outside the intended download directory. The issue exists in the add package() function within the src/pyload/core/api/ init .py component. The sanitization process uses string replacement that can be bypassed; specifically, the pattern ....// is partially removed to become .. , leaving .. sequences that the operating system resolves, enabling path traversal. This can be exploited via the /api/set package data endpoint by manipulating the folder variable.

Recommendations Update to version 0.5.0b3.dev100 or later.