Pyload EUVD-2026-19738

The CVSS 3.1 score of 5.3 reflects a medium-severity vulnerability with network attack vector, high complexity, no privilege requirement, and user interaction (requires user to extract a tar file). The EPSS exploitation probability and KEV status are not provided; however, the attack vector is network-accessible and the user-interaction barrier is minimal in typical download manager workflows where users routinely extract archives. The technical impact is high integrity (arbitrary file write), though no confidentiality or availability impact is specified. The CVSS AC:H (High Complexity) rating suggests the attack requires specific tar archive crafting, which is technically feasible but not trivial. Without KEV confirmation or POC publication status in the input data, this should be treated as a real integrity risk to pyLoad users rather than a theoretical issue-any user extracting a malicious tar file from an untrusted source risks system compromise. The fact that a prior similar fix (CVE-2026-32808) exists in the codebase but was incompletely applied elevates concern about ongoing maintenance rigor.

An attacker crafts a malicious tar archive containing files with carefully constructed paths (e.g., using '../' sequences designed to exploit character-level prefix matching) that bypass the path traversal check. When a pyLoad user downloads this archive and attempts to extract it, the _safe_extractall() function incorrectly validates the paths as safe, and files are written outside the intended extraction directory-potentially overwriting configuration files, plugins, or system executables. The high complexity rating reflects the need for precise tar structure crafting, but the requirement for user interaction (extracting the archive) is a standard operation in a download manager context.