CVE-2025-54802

Advisory

Affected versions of the pyLoad-ng package are vulnerable to Path Traversal due to insufficient sanitization of the package parameter in the CNL blueprint. The /addcrypted endpoint in src/pyload/webui/app/blueprints/cnl_blueprint.py constructs file paths using user-supplied input without properly validating directory traversal sequences, only removing forward slashes, backslashes, and colons while leaving path traversal patterns intact. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malicious package parameter containing directory traversal sequences to write arbitrary files to the system, including cron jobs or systemd services, achieving remote code execution as root.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-48rp-jc79-2264
• https://github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54802