pyLoad: Arbiträres Löschen von Dateien durch Pfadüberschreitung während der verschlüsselten 7z-Passwortverifizierung

The core of the vulnerability lies in how pyLoad handles password verification for encrypted 7z archives. Specifically, when verifying a password, the software derives an archive entry name from the 7z listing output and treats it as a filesystem path without proper validation. An attacker can craft a malicious 7z archive with a specially crafted listing that includes path traversal sequences (e.g., ../..). When pyLoad attempts to extract this archive and verify the password, it will incorrectly interpret the crafted path, allowing the attacker to delete files outside of the intended extraction directory. This could lead to data loss, system instability, or even complete compromise of the system running pyLoad, depending on the permissions of the user running the application.

Users who rely on pyLoad for downloading files and are running versions prior to 0.5.0b3.dev97 are at risk. This includes individuals and organizations using pyLoad in automated download scripts or as part of their workflow. Shared hosting environments where multiple users share the same pyLoad installation are particularly vulnerable, as a compromised archive could affect all users on the system.

• linux / server:

find / -type f -name '*.7z' -mtime +7 -print # Identify old 7z archives
journalctl -u pylload -f | grep -i "password verification" # Monitor password verification logs

• python:

import os
import hashlib
# Check for unusual file paths during password verification
# (This requires code analysis of the pyLoad source code)

• generic web: Inspect web server access logs for requests containing unusual file paths or attempts to access 7z archives from untrusted sources.

1. 2026-03-20Disclosure

   disclosure

1. Reserviert2026-03-16
2. Veröffentlicht2026-03-20
3. Geändert2026-03-25
4. EPSS aktualisiert2026-03-27

The primary mitigation for CVE-2026-32808 is to immediately upgrade pyLoad to version 0.5.0b3.dev97 or later, which contains the fix. If upgrading is not immediately feasible, consider restricting the directories accessible to the pyLoad process to minimize the potential impact of a successful exploit. Implement strict file permissions to prevent unauthorized file deletion. Monitoring file system activity for unexpected deletions, particularly in sensitive directories, can also help detect potential exploitation attempts. After upgrading, confirm the fix by attempting to extract a test 7z archive with a known malicious path traversal entry and verifying that the extraction is properly constrained to the intended directory.