Medium, CVSS 6.5PyPIAmendedPublished
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
CVE-2026-40491 · GHSA-76hw-p97h-883f
- Affected
- PyPI gdown <= 5.2.1
- Fixed in
- 5.2.2· Vendor fix available
- Issue
- The gdown library (tested on v5.2.1) is vulnerable to a Path Traversal attack within its extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Details The vulnerability exists in gdown/extractall.py within the extractall() function. The function takes an archive path and a destination directory (to), then calls the underlying extractall() method of Python's tarfile or zipfile modules without validating whether the archive members stay within the to boundary. Vulnerable Code: Even on modern Python versions (3.12+), if the filter parameter is not explicitly set or if the library's wrapper logic bypasses modern protections, path traversal remains possible as demonstrated in the PoC. PoC Steps to Reproduce 1. Create…
Recommended action: Upgrade to 5.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.