VYPR
← All advisories
High severity7.1NVD Advisory· Published Mar 7, 2026· Updated Jun 17, 2026

CVE-2026-29778

CVE-2026-29778

Description

pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insufficient sanitization for the pack_folder parameter. The current protection relies on a single-pass string replacement of "../", which can be bypassed using crafted recursive traversal sequences. This issue has been patched in version 0.5.0b3.dev97.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pyload-ngPyPI
>= 0.5.0b3.dev13, < 0.5.0b3.dev970.5.0b3.dev97

Affected products

3
  • Pyload/Pyload Ng
    cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:*
    Range: >=0.5.0b3.dev13,<0.5.0b3.dev97
  • ghsa-coords
    pkg:pypi/pyload-ng
    Range: >= 0.5.0b3.dev13, <= 0.5.0b3.dev96
  • Pyload/Pyloadv5
    Range: >= 0.5.0b3.dev13, < 0.5.0b3.dev97

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.