CVE-2025-54140: Path Traversal in pyLoad-ng

The impact of CVE-2025-54140 is severe due to the potential for arbitrary file writes. An attacker who successfully exploits this vulnerability can overwrite critical system files, inject malicious code, or establish persistent backdoors. This could lead to complete system compromise, allowing the attacker to gain full control over the affected server. The ability to write arbitrary files also opens the door to privilege escalation, as an attacker could potentially overwrite binaries to gain higher-level access. The vulnerability's reliance on authentication limits the immediate attack surface, but once authenticated, the impact is substantial. This resembles other path traversal vulnerabilities where attackers leverage predictable file system structures to gain unauthorized access.

1. Reserved2025-07-16
2. Published2025-07-21
3. Modified2025-07-23
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-54140 is to immediately upgrade pyLoad-ng to version 0.5.0b3.dev90 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file upload permissions to the pyLoad user account to minimize the potential impact of a successful exploit. Implement strict filename validation on the /json/upload endpoint, rejecting any filenames containing directory traversal characters (e.g., ..). Consider using a Web Application Firewall (WAF) with rules to detect and block requests containing suspicious filenames. Monitor pyLoad logs for unusual file creation or modification activity. After upgrading, confirm the fix by attempting a file upload with a filename containing directory traversal characters; the upload should be rejected.