Le Blueprint CNL de pyLoad permet un Path Traversal via `dlc_path` qui mène à une Exécution de Code à Distance (RCE)

The vulnerability lies within the addcrypted endpoint, specifically in how it handles the package parameter. Due to insufficient path validation, an attacker can craft a malicious request that allows them to write files outside the intended storage directory. This arbitrary file write capability is exceptionally dangerous. An attacker could overwrite critical system files, such as cron jobs or systemd service configurations, effectively gaining persistent root access to the system. The potential for lateral movement is significant, as a compromised pyLoad-ng instance could be used as a springboard to attack other systems on the network. The blast radius extends to the entire system, as successful exploitation grants the attacker complete control.

Systems running pyLoad-ng in production environments, particularly those with exposed web interfaces, are at significant risk. Shared hosting environments where multiple users share the same server instance are especially vulnerable, as a compromise of one pyLoad-ng instance could potentially affect other users on the same server. Legacy configurations with outdated pyLoad-ng versions are also at heightened risk.

• python: Monitor pyLoad-ng logs for requests to the /addcrypted endpoint with suspicious package parameters containing path traversal sequences (e.g., ../). • linux / server: Use auditd to monitor file access attempts within the pyLoad-ng storage directory. Create an audit rule to specifically track writes to files outside the designated storage area.

auditctl -w /path/to/pyload-ng/storage -p wa -k pyload-rce

• generic web: Use curl to test the /addcrypted endpoint with a path traversal payload:

curl -X POST -d 'package=../../../../etc/passwd' http://your-pyload-ng-server/addcrypted

• generic web: Examine web server access logs for requests to /addcrypted with unusual or unexpected package values.

1. 2025-08-04Disclosure

   disclosure

2. 2025-08-04Patch

   patch

1. Réservé2025-07-29
2. Publiée2025-08-04
3. Modifiée2025-08-05
4. EPSS mis à jour2026-03-23

The primary mitigation is to immediately upgrade pyLoad-ng to version 0.5.0b3.dev90 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the addcrypted endpoint using a firewall or access control list (ACL) to limit potential attackers. Monitor system files and directories for unexpected modifications, particularly those related to cron jobs and systemd services. Implement a Web Application Firewall (WAF) with rules to detect and block requests containing malicious path traversal attempts. Review and harden the overall security posture of the system hosting pyLoad-ng, ensuring that other potential attack vectors are addressed. After upgrading, confirm the fix by attempting to access the addcrypted endpoint with a crafted path traversal payload; the request should be rejected.