CVE-2025-54802

The addcrypted endpoint in the CNL Blueprint module of pyLoad-ng constructs the target file path in an unsafe manner, without proper sanitization of the package parameter. An attacker can submit a specially crafted request containing path traversal sequences (e.g., '../'), which allows writing a file to any location in the file system — outside the intended storage directory. The vulnerability is available without authentication (PR:N, UI:N). By overwriting critical system files, such as cron jobs or systemd services, an attacker can cause privilege escalation and execute arbitrary code as root.

An attacker without any privileges can write arbitrary files to the server's file system, overwrite critical system files, and thus gain full control of the host with root privileges (RCE, privilege escalation).

pyLoad-ng should be immediately updated to version 0.5.0b3.dev90, in which the vulnerability has been fixed. The fix commit is available at: https://github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4. Until the update is applied, it is recommended to restrict network access to the pyLoad-ng instance exclusively to trusted IP addresses.

pyLoad-ng (Pyload-Ng Project) in versions 0.5.0b3.dev89 and earlier.