Описание
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.dev100.
Ссылки
- ExploitVendor Advisory
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.5.0b3.dev100 (исключая)
cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:*
EPSS
Процентиль: 27%
0.00342
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-22
Связанные уязвимости
CVSS3: 6.5
debian
3 месяца назад
pyLoad is a free and open-source download manager written in Python. P ...
CVSS3: 6.5
github
3 месяца назад
PyLoad Vulnerable to Path Traversal via Package Folder Name
EPSS
Процентиль: 27%
0.00342
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-22