A path traversal vulnerability in pyLoad allows authenticated attackers to perform unauthorized file operations, posing a significant risk to system integrity.

The edit_package function fails to properly sanitize the pack_folder parameter, as the existing protection only performs a single-pass removal of directory traversal sequences. This allows an authenticated attacker to bypass the filter and potentially access or modify files outside the intended directory.

The vulnerability carries a CVSS score of 7.1, indicating a high-severity risk. Successful exploitation could lead to unauthorized file modification or system disruption, potentially compromising the integrity of the host environment where the download manager is deployed.

Immediate Action: Update pyLoad to version 0.5.0b3.dev97 or later to implement the corrected input sanitization logic.

Proactive Monitoring: Review application access logs for anomalous requests containing directory traversal sequences, such as repeated instances of encoded or nested path characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block path traversal attempts, specifically targeting recursive "../" patterns within application parameters.

Public Exploit Available: Unknown

Given the high severity of this path traversal flaw and the existence of proof-of-concept evidence, administrators should prioritize updating to version 0.5.0b3.dev97 immediately. Failure to patch leaves the application susceptible to unauthorized file manipulation by authenticated users, which could lead to broader system compromise.