External risk intelligence

pyLoad Archive Extraction Vulnerability Allows Host Compromise.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-123815

pyLoad is a network-accessible download manager commonly deployed as a web-based service or application. While the vulnerability requires authenticated access, the service is designed to be reachable via a network interface to facilitate remote file management, making it likely that such an interface is exposed in a deployment context.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the pyLoad download manager could allow an authenticated user to extract crafted archives containing special files. When running with elevated privileges, this could potentially lead to the compromise of the host system by exposing raw devices or creating communication conflicts.

Malicious archives could exploit pyLoad's extraction process.
It matters if pyLoad runs with elevated system privileges.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with basic permissions can initiate a crafted archive extraction process. This process targets a vulnerability in how pyLoad handles tar archives, specifically allowing the extraction of special file types like character devices or FIFOs. On systems with sufficient privileges, this can lead to the compromise of raw host devices, while on less privileged systems, it may cause service disruptions.

Authenticated access required.
Exploits archive extraction logic.
Risk of host compromise or hangs.

Live Threat

Current exploitation, exposure, and threat context

A crafted archive can lead to the extraction of special file types. When pyLoad operates with sufficient system privileges, this could allow for the creation of raw devices or FIFOs, potentially impacting the host system or causing service disruptions. This risk is more pronounced in privileged environments like root-based Docker deployments, but non-root deployments may still face issues with FIFO creation.

Raw devices or host system compromise.
Extraction of crafted archive with special files.
Service disruption or host compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability in pyLoad, especially in containerized or privileged environments. The initial step involves identifying all instances of pyLoad, assessing their network reachability and business criticality, and confirming the accountable owner for each instance. Remediation planning should then be prioritized based on this risk assessment.

Identify pyLoad instances and owners.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is pyLoad and how is it used?

pyLoad is a free, open-source download manager built on the Python programming language. It is designed to automate and manage file downloads, often serving as a web-based application that allows users to remotely control and queue files for retrieval. Its architecture relies on various plugins to handle different file types and extraction processes.

How does CVE-2026-123815 affect file extraction?

This vulnerability involves Improper Limitation of a Pathname to a Restricted Directory (CWE-22) and Unrestricted Upload of File with Dangerous Type (CWE-434). When processing tar archives, the software fails to reject special file types like character or block devices. Instead of being safely extracted, these files can be created on the host filesystem, potentially allowing an attacker to manipulate host-level resources.

What must occur for this vulnerability to be triggered?

An attacker must have authenticated access with permissions to add and manage files within the application. The trigger requires uploading and initiating the extraction of a specially crafted tar archive containing prohibited special file types. The bug does not trigger if the application is running on Python 3.14 or later, which defaults to a safe archive extraction filter that blocks these dangerous file types automatically.

Do I need to worry about this if my instance is internal?

According to Halo Surface Signal, pyLoad is frequently deployed as a network-accessible service to enable remote management, which often results in instances being reachable over a network. Even if your instance is not directly on the public internet, any authenticated user—including potentially compromised internal accounts—could leverage this flaw if they have the necessary application permissions.

How should I respond to this pyLoad advisory?

The primary step is to update your pyLoad installation to version 0.5.0b3.dev102 or later, which contains the fix. Simultaneously, identify all running instances and verify their deployment context, specifically checking if they are running with root or elevated operating-system privileges, as these environments are significantly more susceptible to host-level compromise.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.