pyLoad, a popular open‑source download manager, contains a path traversal flaw in its set_package_data() API. When an attacker with the Perms.MODIFY permission supplies a folder name under the key "_folder", the value is concatenated directly to the host’s file system path without any form of sanitization. This omission allows the attacker to specify directories outside the intended download directory, enabling the creation or modification of any file on the system. The ability to overwrite critical files or place malicious payloads can lead to remote code execution or complete compromise of the host.

The vulnerability exists in every version of pyLoad before 0.5.0b3.dev100. Administrators should determine whether their installations are running one of these older releases. Versions 0.5.0b3.dev100 and later have added path sanitization to the set_package_data() handler, eliminating the flaw.

The CVSS score of 8.1 indicates a high severity issue. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation to date. Exploitation requires the attacker to have Modify privileges and the ability to invoke set_package_data(); therefore the threat is primarily privileged and local. The problem is classified as CWE‑22 and CWE‑36, covering relative and absolute path traversal.