VYPR
← All advisories
High severity8.1NVD Advisory· Published Mar 20, 2026· Updated Jun 17, 2026

CVE-2026-32808

CVE-2026-32808

Description

pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside of the extraction directory. During password verification, pyLoad derives an archive entry name from 7z listing output and treats it as a filesystem path without constraining it to the extraction directory. This issue has been fixed in version 0.5.0b3.dev97.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Pyload/Pyload Ng
    cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:*
    Range: >=0.5.0a5.dev528,<0.5.0b3.dev97
  • Pyload/Pyload3 versions
    cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*range: <=0.4.20
    • (no CPE)range: <0.5.0b3.dev97
    • (no CPE)range: >= 0.4.9-6262-g2fa0b11d3, < 0.5.0b3.dev97

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.