What is the CVSS score of CVE-2026-32808?

CVE-2026-32808 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2026-32808?

pyLoad versions before 0.5.0b3.dev97 contain a path traversal vulnerability that allows attackers to delete arbitrary files on systems running the download manager, potentially compromising system…. A patch is available.

How to fix or mitigate CVE-2026-32808?

Within 24 hours: identify all systems running pyLoad and document current versions. Within 7 days: upgrade all affected pyLoad installations to version 0.5.0b3.dev97 or later, and restrict network access to pyLoad services to trusted sources only. Within 30 days: conduct file integrity monitoring review and verify no unauthorized file deletions occurred on affected systems.

Python CVE-2026-32808

EUVD-2026-13435 HIGH

Path Traversal (CWE-22)

2026-03-20 security-advisories@github.com

Path Traversal Python

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:20 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

0.5.0b3.dev97

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13435

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 02:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with non-encrypted headers), causing arbitrary file deletion outside of the extraction directory. During password verification, pyLoad derives an archive entry name from 7z listing output and treats it as a filesystem path without constraining it to the extraction directory. This issue has been fixed in version 0.5.0b3.dev97.

AnalysisAI

pyLoad, a free and open-source download manager written in Python, contains a path traversal vulnerability in versions before 0.5.0b3.dev97 that allows arbitrary file deletion outside the extraction directory during password verification of encrypted 7z archives with non-encrypted headers. Attackers can exploit this vulnerability remotely with low complexity, requiring only user interaction, to delete arbitrary files on the system. This is assigned CVE-2026-32808 with a CVSS score of 8.1 (High severity), though no active exploitation (KEV) or public proof-of-concept has been reported at this time.

Technical ContextAI

This vulnerability affects pyLoad, a Python-based download manager, and stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal). During the password verification phase for 7z archives that have encrypted files but non-encrypted headers, pyLoad extracts archive entry names from 7z listing output and treats these names as filesystem paths without proper validation or sanitization to ensure they remain within the intended extraction directory. This allows specially crafted archive entry names containing path traversal sequences (such as ../ or absolute paths) to reference files outside the extraction boundary, leading to arbitrary file deletion when the verification process attempts to access or clean up temporary files. The affected product is specifically pyload versions 0.4.9-6262-g2fa0b11d3 through all versions prior to 0.5.0b3.dev97, as confirmed by ENISA EUVD-2026-13435.

RemediationAI

Upgrade pyLoad to version 0.5.0b3.dev97 or later, which contains the fix for this path traversal vulnerability as documented in the GitHub Security Advisory at https://github.com/pyload/pyload/security/advisories/GHSA-7g4m-8hx2-4qh3. Organizations should prioritize updating all pyLoad installations, particularly those in environments where users regularly process untrusted or external archive files. As an interim mitigation until patching is completed, administrators should restrict pyLoad's ability to process 7z archives from untrusted sources, implement strict file system permissions to limit the scope of potential file deletions, and consider running pyLoad with minimal privileges in a sandboxed or containerized environment to contain potential damage from path traversal attacks. User awareness training to avoid processing archives from unknown or suspicious sources can also reduce the attack surface given the user interaction requirement.