CVE-2026-35592: 
Python vulnerability analysis and mitigation

CVE-2026-35592 is a path traversal vulnerability in pyLoad's UnTar extractor that allows a specially crafted tar archive to write files outside the intended extraction directory. It affects pyload-ng versions up to and including 0.5.0b3.dev96 and pyload versions up to and including 0.4.20. The vulnerability was published on April 7, 2026, and stems from an incomplete fix for a prior related issue (CVE-2026-32808 / GHSA-7g4m-8hx2-4qh3). It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, or 5.3 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Red Hat).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs character-level string comparison rather than path-level comparison. For example, given an extraction path of /downloads/pkg and a malicious tar member resolving to /downloads/pkg_evil/payload, os.path.commonprefix() returns /downloads/pkg — matching the base directory and incorrectly passing the check — whereas the correct os.path.commonpath() would return /downloads, which would not match and would block extraction. The correct is_within_directory() function using os.path.commonpath() was already added to src/pyload/core/utils/fs.py as part of the fix for GHSA-7g4m-8hx2-4qh3 (commit 5f4f0fa), but was never applied to _safe_extractall(), making this an incomplete fix. A self-contained PoC Python script is publicly available in the GitHub Security Advisory (GitHub Advisory).

Successful exploitation allows an attacker to write arbitrary files to sibling directories outside the intended extraction path, potentially overwriting other users' downloads, planting malicious files in predictable locations, or overwriting configuration files such as .bashrc, cron jobs, or pyLoad plugin files. If combined with other primitives, this arbitrary file write can escalate to code execution. The attack requires user interaction — the victim must download a malicious archive (manually or via the pyLoad API with ADD permission) and have the ExtractArchive addon enabled — and has no confidentiality or availability impact, only a high integrity impact (GitHub Advisory).

A public proof-of-concept exploit is available in the GitHub Security Advisory as a self-contained Python script that creates a malicious tar archive, executes the vulnerable check, and confirms file escape outside the intended directory (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.031% (0.000310), indicating low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Qualys has detection coverage for this issue (detection ID 5010621) (Feedly).

1. Craft a malicious tar archive: Create a .tar.gz file containing a member with a path-traversal name such as ../target_sibling_dir/evil.txt. The member name is crafted so that os.path.commonprefix() returns the extraction base directory, bypassing the check.
2. Host the archive: Upload the malicious archive to a file hosting service or any URL accessible by the target pyLoad instance.
3. Trigger download: Either socially engineer the victim into adding the malicious archive URL to pyLoad for download, or (if the attacker has ADD API permission) submit it via the pyLoad API.
4. Extraction triggered: When pyLoad's ExtractArchive addon processes the downloaded archive, it calls ExtractArchive.package_finished() → extract_queued() → UnTar.extract() → _safe_extractall(), which performs the flawed path check.
5. Path traversal bypass: The _is_within_directory() check using os.path.commonprefix() incorrectly returns True for the malicious member path, allowing tar.extractall() to write the file outside the intended extraction directory.
6. Achieve objective: The attacker's file (e.g., a malicious cron job, .bashrc, or plugin file) is written to a predictable location on disk, potentially enabling follow-on code execution (GitHub Advisory).

• File System: Unexpected files appearing in sibling directories adjacent to the configured pyLoad extraction directory (e.g., /downloads/pkg_evil/ when extraction target is /downloads/pkg/); newly created or modified files such as .bashrc, cron entries, or pyLoad plugin files owned by the pyLoad service account.
• Logs: pyLoad extraction logs showing archives with member names containing ../ path components; absence of ArchiveError exceptions for archives that should have triggered path traversal detection.
• Network: Outbound connections from the pyLoad host to unfamiliar file hosting URLs shortly before unexpected files appear on disk; downloads of .tar.gz files from untrusted or newly registered domains.
• Process: Unexpected processes spawned by the pyLoad service account following archive extraction, particularly shells or interpreters, which may indicate follow-on code execution via planted configuration files (GitHub Advisory).

Update pyLoad to version 0.5.0b3.dev97 or later (pyload-ng), which replaces the broken inline _is_within_directory() function in UnTar.py with the correct is_within_directory() from pyload.core.utils.fs that uses os.path.commonpath(). Until patching is possible, avoid extracting tar archives from untrusted sources and disable the ExtractArchive addon if not required. Additionally, apply the principle of least privilege to the pyLoad service account and implement file integrity monitoring on the extraction directory and adjacent critical system paths (GitHub Advisory).

The vulnerability was reported by researcher GammaC0de and published via GitHub Security Advisory on April 4, 2026. Red Hat tracked the issue and published their own advisory on April 8, 2026. No significant broader media coverage or notable community debate has been identified beyond the standard vulnerability disclosure channels (GitHub Advisory, Red Hat).