An authenticated path traversal vulnerability in pyLoad allows attackers to write arbitrary files, creating a high risk of remote code execution and system compromise.

This is a path traversal vulnerability (CWE-22) located in the /json/upload endpoint. By manipulating the filename parameter, an authenticated attacker can escape the intended upload directory and write files to arbitrary locations on the host system.

The ability to write arbitrary files to the filesystem poses a severe threat to business operations. An attacker can leverage this flaw to gain remote code execution, escalate privileges, or establish persistence via backdoors, leading to a full system compromise. With a CVSS score of 7.5, this vulnerability represents a significant risk to data integrity and infrastructure security.

Immediate Action: Update the pyLoad-ng software to version 0.5.0b3.dev90 or later to include the security fix.

Proactive Monitoring: Monitor server access logs for unusual activity on the /json/upload endpoint and inspect file system integrity for unauthorized files created outside of designated upload directories.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and sanitize filename parameters in HTTP requests, specifically blocking directory traversal sequences such as double dots (..) and forward slashes.

Public Exploit Available: No (Exploit_available: unknown).

Given the potential for remote code execution and the existence of a proof-of-concept, this vulnerability should be prioritized for remediation. Organizations running the affected versions of pyLoad must apply the patch immediately to prevent unauthorized file writes and potential system takeover.