Path Traversal in Pyload
CVE-2025-54802
pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE). The addcrypted endpoint in pyload-ng suffers from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside the designated storage directory. This can be abused to overwrite critical system files, including cron jobs and systemd services, leading to privilege escalation and remote code execution as root. This issue is fixed in version 0.5.0b3.dev90.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.012 (66.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 67th percentile — 66.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000
Affected products
- Pyload — versions >= 0.5.0b3.dev89, < 0.5.0b3.dev90
- Pyload-Ng Project — versions 0.5.0b3.dev89
Weakness classification (CWE)
References
- github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264 (Exploit, Vendor Advisory)
- github.com/pyload/pyload/pull/4596 (Exploit, Patch)
- github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4 (Patch)
Frequently asked questions
- What is CVE-2025-54802?
- CVE-2025-54802 is a critical-severity vulnerability in Pyload, classified under Path Traversal. CVSS score: 9.8/10. Published 2025-08-05.
- How severe is CVE-2025-54802?
- Critical severity. CVSS v3 base score is 9.8 out of 10.