CVE-2026-32808

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside of the extraction directory. During password verification, pyLoad derives an archive entry name from 7z listing output and treats it as a filesystem path without constraining it to the extraction directory. This issue has been fixed in version 0.5.0b3.dev97.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
pyload	pyload	>= 0.4.9-6262-g2fa0b11d3, < 0.5.0b3.dev97

References

https://github.com/pyload/pyload/security/advisories/GHSA-7g4m-8hx2-4qh3Exploit, Mitigation, Vendor Advisory

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-32817.8A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conversion/bandrank.c. Per CVE-2026-328105.5Halloy is an IRC application written in Rust. In versions on \*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, hallo CVE-2026-328117.5Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. When using Heimdall in envoy gRPC decision API mode wit CVE-2026-328126.8Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can resu CVE-2026-328138.0Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList co CVE-2026-328146.5libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decodi CVE-2026-328157.5SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the WebSocket endpoint (/ws) allows unauthenticated connectio CVE-2026-328165.7Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the delete, activate, and deactivate modes in modules/g CVE-2026-328179.1Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether CVE-2026-328186.5Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the forum module in Admidio does not verify whether the CVE-2026-328194.3dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the mod CVE-2026-32827.1A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unp