Vulnerability · Published Apr 18, 2026 · Assigned by GitHub_M

CVE-2026-40491gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall

Medium 6.5

In plain English

A medium-severity path traversal in gdown from wkentaro. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 52.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	gdown	5.2.0+dfsg-2+deb13u1	DEBIAN-CVE-2026-40491
Debian:14	gdown	6.0.0+dfsg-1	DEBIAN-CVE-2026-40491
PyPI	gdown	5.2.2	PYSEC-2026-2158
PyPI	gdown	5.2.2	GHSA-76hw-p97h-883f
Ubuntu:25.10	gdown	no fix listed	UBUNTU-CVE-2026-40491
Ubuntu:26.04:LTS	gdown	no fix listed	UBUNTU-CVE-2026-40491
Ubuntu:26.10	gdown	no fix listed	UBUNTU-CVE-2026-40491

Affected products (as reported)

Vendor	Product	Versions
wkentaro	gdown	< 5.2.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

https://github.com/wkentaro/gdown/security/advisories/GHSA-76hw-p97h-883f x_refsource_CONFIRM
https://github.com/wkentaro/gdown/commit/af569fc6ed300b7974dee66dc51e9f01b57b4dff x_refsource_MISC
https://github.com/wkentaro/gdown/releases/tag/v5.2.2 x_refsource_MISC