CVE-2026-42314

6.5 mediumEPSS 0.3%

Medium (6.5) in pyload-ng project pyload-ng. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in pyload-ng 0.5.0b3.dev100.

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.dev100.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2026-05-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pyload-ng_project:pyload-ng

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-97r3-5w84-r4q8	PyPI	pyload-ng	<0.5.0b3.dev100	0.5.0b3.dev100
PYSEC-2026-128	PyPI	pyload-ng	<0.5.0b3.dev100	0.5.0b3.dev100

References

Check your stack JSON