A path traversal flaw exists during password verification of encrypted 7z archives that have non-encrypted headers. The vulnerability allows a crafted archive to cause pyLoad to delete files outside its intended extraction directory, leading to loss of data and potential system compromise. The weakness is identified as a location-based input validation error.

The pyLoad download manager, including the pyload-ng project, is affected. Versions prior to 0.5.0b3.dev97 lack the fix; all earlier releases are vulnerable.

The flaw carries a CVSS score of 8.1, indicating high severity, while EPSS is below 1%, suggesting a low likelihood of widespread exploitation. It is not listed in CISA’s KEV catalog. An attacker would need to supply a malicious 7z file that passes encryption header checks, then trigger the password verification routine to delete arbitrary files. The impact is limited to files accessible by the user account under which pyLoad runs.