CVE-2026-123815 pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123815?
CVE-2026-123815 is a critical vulnerability in pyload, published on 9 Nov 2026.
Official description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling tarfile.extractall. On supported Python 3.9 through 3.13 runtimes, tarfile defaults to the fully_trusted extraction filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. Python 3.14 defaults to a safe extraction filter. When pyLoad runs with operating-system privileges that permit device creation, including the official root-based Docker deployment, the archive can expose raw devices and compromise the host. Non-root deployments can still create FIFOs that cause hangs or IPC confusion. This issue is fixed in version 0.5.0b3.dev102.
Which versions are affected by CVE-2026-123815?
1 open source package ship an affected version, including pyload-ng.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions to 0.5.0b3.dev101 | None |
How do I fix CVE-2026-123815?
No fix has been published for CVE-2026-123815 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123815 being exploited?
There is no known exploitation of CVE-2026-123815 in the wild and no public exploit code.
Sources
Also known as GHSA-fr26-jjhm-638c.