What is the CVSS score of CVE-2026-35592?

CVE-2026-35592 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35592?

Yes, a patch is available for CVE-2026-35592. Update the affected software to the latest version immediately.

Python CVE-2026-35592

EUVD-2026-19738 MEDIUM

Path Traversal (CWE-22)

2026-04-07 GitHub_M

GHSA-mvwx-582f-56r7

Python Path Traversal

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 07, 2026 - 16:30 euvd

EUVD-2026-19738

Analysis Generated

Apr 07, 2026 - 16:30 vuln.today

CVE Published

Apr 07, 2026 - 16:11 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function os.path.commonpath() was added to the codebase in the CVE-2026-32808 fix (commit 5f4f0fa) but was never applied to _safe_extractall(), making this an incomplete fix. This vulnerability is fixed in 0.5.0b3.dev97.

AnalysisAI

Path traversal in pyLoad's tar extraction allows writing files outside the intended directory via specially crafted archives. The vulnerability stems from incomplete remediation of a prior path traversal fix (CVE-2026-32808), where the _safe_extractall() function continues to use the insecure os.path.commonprefix() instead of the correct os.path.commonpath(). Unauthenticated remote attackers can exploit this via a malicious tar file when a user extracts it, achieving arbitrary file write on the system. The vulnerability affects pyLoad versions prior to 0.5.0b3.dev97 and is fixed in that release.

Technical ContextAI

pyLoad is a Python-based download manager that includes tar archive extraction functionality. The vulnerability resides in src/pyload/plugins/extractors/UnTar.py's _safe_extractall() function, which attempts to prevent directory traversal attacks using path validation. However, os.path.commonprefix() performs character-level string comparison rather than true path-level analysis-for example, '/extracted/dir' and '/extracted/directory' share the character-level prefix '/extracted/dir', allowing traversal checks to be bypassed with specially crafted relative paths like '../../../'. The correct function os.path.commonpath() was introduced in commit 5f4f0fa to fix the related CVE-2026-32808, but this fix was never applied to _safe_extractall(), representing an incomplete vulnerability remediation. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal vulnerability.

RemediationAI

The primary fix is to upgrade pyLoad to version 0.5.0b3.dev97 or later, which corrects the _safe_extractall() function to use os.path.commonpath() instead of os.path.commonprefix(). Users unable to immediately upgrade should avoid extracting tar archives from untrusted sources until patching is possible. No workarounds that maintain full functionality are documented; the vulnerability is architectural to the extraction logic. Full details and security advisory information are available at https://github.com/pyload/pyload/security/advisories/GHSA-mvwx-582f-56r7.