Log in Start free

Vulnerability · Published Jul 22, 2025 · Assigned by GitHub_M

CVE-2025-54140pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write

High 7.5

In plain English

A high-severity path traversal in pyload from pyload. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 44.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated path traversal vulnerability exists in the /json/upload endpoint of pyLoad. By manipulating the filename of an uploaded file, an attacker can traverse out of the intended upload directory, allowing them to write arbitrary files to any location on the system accessible to the pyLoad process. This may lead to: Remote Code Execution (RCE), local privilege escalation, system-wide compromise, persistence, and backdoors. This is fixed in version 0.5.0b3.dev90.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIpyload-ng0.5.0b3.dev90GHSA-xqpg-92fq-grfg
PyPIpyload-ng0.5.0b3.dev90PYSEC-2026-1823

Affected products (as reported)

VendorProductVersions
pyload pyload >= 0.5.0b3.dev89, < 0.5.0b3.dev90

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References