CVE-2024-47821

Advisory

Affected versions of pyLoad are vulnerable to path traversal via the storage_folder configuration setting. This vulnerability allows attackers to write files to arbitrary locations by manipulating the storage_folder path, potentially leading to arbitrary file writes and code execution. The vulnerability exists in the Core.init and Api.set_config_value functions where storage paths aren't properly validated. Attackers with access to configuration settings can exploit this through the web interface. Users should update to the version which implements proper path validation and restriction checks.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-w7hq-f2pj-c53g
• https://github.com/pyload/pyload/commit/48f59567393a19263c8a0285256a7537dc9ce109
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47821