The gdown library contains a path traversal flaw in its extractall function, where the names of files inside ZIP or TAR archives are not validated before extraction. This allows an attacker to craft an archive that writes files outside the intended destination directory, leading to arbitrary file overwrite and the potential for remote code execution, as the overwritten files could be privileged executables or configuration files. The weakness is classified as CWE-22.

The library released by wkentaro under the name gdown is vulnerable in all versions before 5.2.2. Users that depend on earlier releases, such as v5.2.1 or older, are impacted. The vulnerability is relevant to Python projects that import gdown for downloading data from Google Drive.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack scenario involves an environment that uses gdown to extract archives freshly downloaded from untrusted sources; the attacker supplies a malicious archive that causes files to be written outside the target directory. If the overwritten files include executables or code that runs with elevated privileges, remote code execution becomes possible. However, exploitability depends on the user’s context and the permissions of the gdown process.