pyLoad hat einen Arbitrary File Write via Path Traversal in edit_package()

The core of the vulnerability lies in the insufficient sanitization of the packfolder parameter within the editpackage() function. The current implementation attempts to prevent path traversal by replacing occurrences of "../", but this is easily bypassed using carefully crafted recursive sequences. For example, a payload like ..././..././..././tmp becomes ../../../tmp after the single-pass replacement, effectively escaping the intended storage directory. Successful exploitation could allow an attacker to overwrite critical system files, execute arbitrary code, or gain unauthorized access to sensitive data, depending on the permissions of the user account running pyload-ng. The blast radius is limited to the system where pyload-ng is running and the privileges of the authenticated user.

Users running pyLoad-ng versions prior to 0.5.0b3.dev97 are at risk, particularly those hosting the application on publicly accessible servers or within shared hosting environments. Systems where pyLoad-ng is used to process user-supplied input for file management are also at higher risk.

• python / server:

import os
import re

def check_pack_folder(pack_folder):
    if '..' in pack_folder:
        # Check for recursive traversal attempts
        if re.search(r'../+', pack_folder):
            print("Potential directory traversal attempt detected!")
            return False
    return True

# Example usage (replace with actual input)
pack_folder = input("Enter pack_folder: ")
if check_pack_folder(pack_folder):
    print("Pack folder is safe.")
else:
    print("Pack folder is potentially unsafe.")

1. 2026-03-05Disclosure

   disclosure

1. Reserviert2026-03-04
2. Veröffentlicht2026-03-05
3. Geändert2026-03-09
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-29778 is to upgrade pyload-ng to version 0.5.0b3.dev97 or later, which includes the necessary sanitization improvements. If upgrading is not immediately feasible, consider restricting access to the edit_package() function or implementing stricter file permissions to limit the potential impact of a successful attack. While not a complete solution, a Web Application Firewall (WAF) could be configured to block requests containing suspicious path traversal sequences. Monitor pyload-ng logs for unusual file access patterns or attempts to write files outside of the expected directories. Review and harden the permissions of the user account running pyload-ng to minimize potential damage.