The vulnerability arises from insufficient sanitization of package folder names in pyLoad. The string replacement mistakenly transforms the pattern "....//" into ".._", leaving a residual "..", which can be interpreted by the operating system as a parent directory reference. During later file resolution, this allows an attacker to drop files outside the intended download directory, potentially reading or writing arbitrary files.

The flaw exists in pyLoad releases before 0.5.0b3.dev100. Any instance of the pyLoad open‑source download manager older than that version is vulnerable.

The CVSS score of 6.5 denotes a moderate severity. EPSS is not reported and the issue is not listed in CISA’s KEV catalog, suggesting limited exploitation activity so far. Exploitation requires an attacker to supply a package with a malicious folder name. If pyLoad is exposed via a network interface that accepts package uploads, the attacker could trigger the path traversal from remote hosts; otherwise local execution could also be possible. The vulnerability does not grant arbitrary code execution but could be leveraged to overwrite critical system files if permissions allow.