PyLoad prior 0.5.0b3.dev102 Untar UnTar.py UnTar._safe_extractall permission

Summaryinfo

A vulnerability categorized as very critical has been discovered in PyLoad prior 0.5.0b3.dev102. This vulnerability affects the function UnTar._safe_extractall of the file src/pyload/plugins/extractors/UnTar.py of the component Untar. The manipulation results in permission. This vulnerability is reported as CVE-2026-123815. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in PyLoad prior 0.5.0b3.dev102. It has been classified as very critical. Affected is the function UnTar._safe_extractall of the file src/pyload/plugins/extractors/UnTar.py of the component Untar. The manipulation with an unknown input leads to a permission vulnerability. CWE is classifying the issue as CWE-275. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling tarfile.extractall. On supported Python 3.9 through 3.13 runtimes, tarfile defaults to the fully_trusted extraction filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. Python 3.14 defaults to a safe extraction filter. When pyLoad runs with operating-system privileges that permit device creation, including the official root-based Docker deployment, the archive can expose raw devices and compromise the host. Non-root deployments can still create FIFOs that cause hangs or IPC confusion. This issue is fixed in version 0.5.0b3.dev102.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-123815 since 11/06/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/09/2026). The MITRE ATT&CK project declares the attack technique as T1222.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• PyLoad

Version

• <0.5.0b3.dev102

Website

• Product: https://github.com/pyload/pyload/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion