High severity8.1GHSA Advisory· Published May 11, 2026· Updated May 15, 2026
CVE-2026-42315
CVE-2026-42315
Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all, allowing a user with Perms.MODIFY to specify arbitrary directories as download locations for a package. This vulnerability is fixed in 0.5.0b3.dev100.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/pyload/pyload/security/advisories/GHSA-838g-gr43-qqg9nvdExploitVendor Advisory
- github.com/advisories/GHSA-838g-gr43-qqg9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-42315ghsa
News mentions
0No linked articles in our index yet.