CVE-2025-54802: RCE in pyLoad-ng via Blueprint File Write

The vulnerability lies within the addcrypted endpoint, specifically in how it handles the package parameter. Due to insufficient path validation, an attacker can craft a malicious request that allows them to write files outside the intended storage directory. This arbitrary file write capability is exceptionally dangerous. An attacker could overwrite critical system files, such as cron jobs or systemd service configurations, effectively gaining persistent root access to the system. The potential for lateral movement is significant, as a compromised pyLoad-ng instance could be used as a springboard to attack other systems on the network. The blast radius extends to the entire system, as successful exploitation grants the attacker complete control.

1. Reserved2025-07-29
2. Published2025-08-04
3. Modified2025-08-05
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade pyLoad-ng to version 0.5.0b3.dev90 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the addcrypted endpoint using a firewall or access control list (ACL) to limit potential attackers. Monitor system files and directories for unexpected modifications, particularly those related to cron jobs and systemd services. Implement a Web Application Firewall (WAF) with rules to detect and block requests containing malicious path traversal attempts. Review and harden the overall security posture of the system hosting pyLoad-ng, ensuring that other potential attack vectors are addressed. After upgrading, confirm the fix by attempting to access the addcrypted endpoint with a crafted path traversal payload; the request should be rejected.