A path traversal flaw in the pyLoad download manager allows unauthenticated attackers to cause arbitrary file deletion, posing a significant risk to system integrity.

The application is susceptible to a path traversal vulnerability (CWE-22) when verifying passwords for encrypted 7z archives. An unauthenticated attacker can manipulate the archive entry name to escape the extraction directory, resulting in arbitrary file deletion on the host filesystem.

The vulnerability carries a CVSS score of 8.1, reflecting a high severity due to the potential for significant impact on system availability and data integrity. Successful exploitation could lead to the deletion of critical configuration files or system data, potentially resulting in complete service disruption and requiring extensive recovery efforts.

Immediate Action: Update pyLoad to version 0.5.0b3.dev97 or later to incorporate the necessary path validation fixes.

Proactive Monitoring: Monitor system logs for unusual file deletion patterns or error messages associated with archive processing tasks.

Compensating Controls: Restrict access to the pyLoad management interface to trusted networks and ensure the application runs with the minimum necessary filesystem permissions to limit the scope of potential damage.

Public Exploit Available: Unknown.

Given the potential for arbitrary file deletion and the existence of proof-of-concept evidence, this vulnerability presents a notable risk to operational stability. Administrators should prioritize updating their pyLoad instances to the patched version immediately. If an immediate update is not possible, ensure that the service is isolated and running with strictly limited user privileges to mitigate the impact of a potential exploit.