CVE-2026-32808: Pyload

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside of the extraction directory. During password verification, pyLoad derives an archive entry name from 7z listing output and treats it as a filesystem path without constraining it to the extraction directory. This issue has been fixed in version 0.5.0b3.dev97.

Affected products

• Pyload Pyload: up to and including 0.4.20
• Pyload-NG Project Pyload-NG: from 0.5.0a5.dev528, before 0.5.0b3.dev97 (fixed in 0.5.0b3.dev97)

Published 2026-03-20. Last modified 2026-06-17.