CVE-2026-32808
High
Description
pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside of the extraction directory. During password verification, pyLoad derives an archive entry name from 7z listing output and treats it as a filesystem path without constraining it to the extraction directory. This issue has been fixed in version 0.5.0b3.dev97.
SeverityHigh
CVSS8.1
Exploit probability—
ProductPyload
PublishedMar 20, 2026
First seenMar 20, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- pyload-ng_project pyload-ng0.5.0b3.dev97 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pyload pyload | v ≤ 0.4.20 | — |
| pyload-ng_project pyload-ng | 0.5.0a5.dev528 ≤ v < 0.5.0b3.dev97 | 0.5.0b3.dev97 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.