CVE-2026-29778: Directory Traversal in pyLoad-ng

The vulnerability lies in the editpackage() function's insufficient sanitization of the packfolder parameter. The current implementation attempts to prevent directory traversal using a single-pass string replacement of "../", but this is easily bypassed with crafted recursive traversal sequences. A successful exploit could allow an attacker to read sensitive files from the server's file system, potentially including configuration files, database credentials, or other confidential data. Depending on the server's configuration and the permissions of the pyLoad-ng process, the attacker might also be able to write files, leading to further compromise.

1. Reserved2026-03-04
2. Published2026-03-05
3. Modified2026-03-09
4. EPSS updated2026-03-23

The primary mitigation is to upgrade pyLoad-ng to version 0.5.0b3.dev97 or later, which includes the necessary sanitization improvements. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious directory traversal patterns, such as multiple "../" sequences. Additionally, restrict the permissions of the pyLoad-ng process to the minimum required to operate, limiting the potential impact of a successful exploit. After upgrade, confirm by attempting to access a restricted file via the edit_package() function to ensure the sanitization is working as expected.