Pyload EUVD-2026-13435

Victim must open a crafted 7z archive with encryption on headers disabled but file content encrypted in pyLoad versions before 0.5.0b3.dev97. Remote attacker sends the malicious archive; victim initiates extraction/password verification through pyLoad UI.

The CVSS 3.1 score of 8.1 indicates high severity with an attack vector of Network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R), with high impact to both integrity (I:H) and availability (A:H) but no confidentiality impact. The requirement for user interaction significantly constrains real-world exploitation scenarios, as an attacker must convince a target to download and process a malicious 7z archive through pyLoad. While the potential for arbitrary file deletion poses serious risks to system integrity and availability, the lack of current EPSS data, absence from CISA KEV catalog, and no public proof-of-concept suggest this is not being actively exploited in the wild. The attack is automatable once user interaction occurs, but the targeting would likely be opportunistic rather than mass-scale. This represents a genuine risk for organizations using affected pyLoad versions, particularly in environments where users regularly process untrusted archive files, but should be prioritized below vulnerabilities with active exploitation or those requiring no user interaction.

An attacker crafts a malicious 7z archive with encrypted files but non-encrypted headers, embedding path traversal sequences in archive entry names that reference critical system files or application configuration files outside the extraction directory (e.g., '../../../etc/important-config' or absolute paths). The attacker then socially engineers a target user into downloading and processing this archive through their pyLoad installation, perhaps by hosting it on a file-sharing service or sending it via phishing. When pyLoad attempts to verify the password for the encrypted archive, it processes the malicious entry names without proper path validation, resulting in the deletion of arbitrary files on the system, potentially causing application failure, data loss, or system instability.