CVE-2026-42314: PyLoad Vulnerable to Path Traversal via Package Folder Name

May 5, 2026 (updated June 8, 2026)

Insufficient sanitization of package folder names allows writing files outside the intended download directory.

References

github.com/advisories/GHSA-97r3-5w84-r4q8
github.com/pyload/pyload/security/advisories/GHSA-97r3-5w84-r4q8
github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-128.yaml
nvd.nist.gov/vuln/detail/CVE-2026-42314

Code Behaviors & Features

Detect and mitigate CVE-2026-42314 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →