CVE-2026-123815— pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

Quick assessment

Affected

pyload pyload

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pyLoad 是一款用 Python 编写的免费开源下载管理器。在 0.5.0b3.dev102 版本之前，位于的方法虽然会验证归档成员的路径和链接目标，但在调用之前，并未通过来拒绝特殊类型的归档成员。在支持的 Python 3.9 至 3.13 运行时环境中，模块默认使用完全信任的提取过滤器（）。因此，拥有和权限的用户可以触发对包含字符设备、块设备或 FIFO（命名管道）的恶意构造归档进行提取。Python 3.14 默认改用安全的提取过滤器。当 pyLoad 以允许创建设备的操作系统权限运行时（

CVSS 9.4 · Critical Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1059.006 · Python T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

Source: CVE Program / CVE List V5

Vulnerability Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling tarfile.extractall. On supported Python 3.9 through 3.13 runtimes, tarfile defaults to the fully_trusted extraction filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. Python 3.14 defaults to a safe extraction filter. When pyLoad runs with operating-system privileges that permit device creation, including the official root-based Docker deployment, the archive can expose raw devices and compromise the host. Non-root deployments can still create FIFOs that cause hangs or IPC confusion. This issue is fixed in version 0.5.0b3.dev102.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pyload	pyload	< 0.5.0b3.dev102	-

II. Public POCs for CVE-2026-123815

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123815

请登录查看更多情报信息。

Other References for CVE-2026-123815 (2)

https://github.com/pyload/pyload/security/advisories/GHSA-fr26-jjhm-638c x_refsource_CONFIRM
https://github.com/pyload/pyload/commit/09eec1b431b6942a1917f094f2c77bfbf5637f60 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-123815

Same Patch Batch · pyload · 2026-11-09 · 4 CVEs total

CVE-2026-123816	8.1 HIGH	pyLoad: Authentication bypass in API key validation (check_apikey cache)
CVE-2026-123813	7.5 HIGH	pyLoad: Privilege revocation and password change through the REST API do not invalidate th
CVE-2026-123814	6.4 MEDIUM	pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.

IV. Related Vulnerabilities

Same product: pyload

Same vendor: pyload

Same weakness: CWE-22