Ali Firasthesmartshadowindependent security research - source-code auditing, vulnerability discovery and coordinated disclosure
TSS-R-2026-001CVE-2026-32808CWE-22
pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification
Public record of CVE-2026-32808, a path traversal in pyLoad's encrypted 7z password verification that allowed a file outside the extraction directory to be deleted. Fixed in pyload-ng 0.5.0b3.dev97.
Archive entry name
smallestA 7z archive names its own entries. The name is chosen by whoever built the archive. SevenZip._find_smallest_file() reads the entry list from the 7z process and returns the smallest entry's name as `smallest`.
Path construction
os.path.joinverify() joins the extraction destination with that name using os.path.join, which resolves a leading traversal segment instead of rejecting it.
After the fixis_within_directory resolves both paths and requires os.path.commonpath to still equal the base, so the same name is refused here instead of resolving.
os.remove(extracted)
os.removeThe joined path is passed straight to os.remove, so the deletion follows wherever the join resolved to.
After the fixThe call is never reached: the path is refused before it is built.
File deleted outside the destination
os.removeA file outside the intended extraction directory is removed. CVSS records no confidentiality impact and high integrity and availability impact.
After the fixNothing outside the destination is reachable.
Every sentence above is read from the record's evidence file, which is generated from the upstream repository at the two commits it cites. The drawing adds no fact of its own, and no exploit sequence is published: the record explains the root cause.
Findings credited to this research
Every advisory published by someone else whose credit names this research as the reporter. The identifier links to the source that establishes the credit, never to an aggregator.
2026
| Identifier | Project | Finding | Weakness | Ecosystem |
|---|---|---|---|---|
| CVE-2026-70622 | tar-rs | Symlink escape in Builder::append_dir_all allows a privileged process to read a file outside the intended root into the archive. | CWE-59 | Rust (crates.io) |
| CVE-2026-68930 | russh | Operation on a resource after expiry, with an authorization check that could be bypassed. | CWE-666 | Rust (crates.io) |
| CVE-2026-67320 | axios | Prototype pollution reachable through request handling, leading to information exposure. | CWE-1321 | npm |
| CVE-2026-59896 | hono | Race condition in request handling. | CWE-362 | npm |
| CVE-2026-48525 | PyJWT | Uncontrolled resource consumption when decoding a crafted token. | CWE-400 | PyPI |
| CVE-2026-45784 | rust-openssl | Incorrect calculation of buffer size leading to an out-of-bounds write. | CWE-131 | Rust (crates.io) |
| CVE-2026-45539 | microsoft/apm | Symlink following on an output path, exposing information outside the intended location. | CWE-59 | Go |
| CVE-2026-44724 | systeminformation | Command injection through unsanitised input reaching process execution. | CWE-78 | npm |
| CVE-2026-44240 | basic-ftp | Uncontrolled resource consumption from an unbounded allocation. | CWE-400 | npm |
| CVE-2026-39360 | RustFS | Missing authorization on a request path. | CWE-862 | Rust (crates.io) |
| CVE-2026-34601 | @xmldom/xmldom | XML injection through incorrectly neutralised markup. | CWE-91 | npm |
| CVE-2026-32936 | CoreDNS | Uncontrolled resource consumption reachable from a crafted request. | CWE-400 | Go |
| CVE-2026-32808 | pyload-ng | Path traversal during encrypted 7z password verification allowed a file outside the extraction directory to be deleted. | CWE-22 | PyPI |
| CVE-2026-25500 | Rack | Stored cross-site scripting from input that was not correctly sanitised. | CWE-79 | RubyGems |
| CVE-2026-10722 | cilium/ebpf | Integer overflow in BTF length checking. | CWE-190 | Go |
Method
I start with the trust boundary, not a scanner result. I trace how external data reaches file operations, parsers, authorization checks, process execution, shared state, cryptographic buffers, or resource allocation.
A useful report should leave a project with more than a finding: a small reproducible case, affected-version analysis, a clear root cause, and a practical fix. Where it makes sense, the patch and its regression tests are written too. Severity stays separate from technical validity.
- Recurring weakness classes
- CWE-400 · 3
- CWE-59 · 2
- CWE-131 · 1
- CWE-1321 · 1
Research atlasThe whole corpus as one drawing: findings, the software they affect, the weakness classes they belong to and the ecosystems they sit in.
- Weakness classesThe CWE class each finding was assigned.
- FindingsVulnerabilities credited to this research, oldest on the left.
- Affected softwareThe package or project each finding affects.
- EcosystemsWhere the affected software is distributed.
- All 15 findings carry 2026 identifiers, so horizontal position is identifier order; the bands are layout, not measurement.
Explore the data48 nodes · 60 relationships
Every node the topology draws and every relationship between them. Positions in the visualisation encode the band and the year; they are not measurements.
Weakness classes12
The CWE class each finding was assigned.
CWE-1901 relationship
Common Weakness Enumeration class
CWE-791 relationship
Common Weakness Enumeration class
CWE-221 relationship
Common Weakness Enumeration class
CWE-4003 relationships
Common Weakness Enumeration class
CWE-911 relationship
Common Weakness Enumeration class
CWE-8621 relationship
Common Weakness Enumeration class
CWE-781 relationship
Common Weakness Enumeration class
CWE-592 relationships
Common Weakness Enumeration class
CWE-1311 relationship
Common Weakness Enumeration class
CWE-3621 relationship
Common Weakness Enumeration class
CWE-13211 relationship
Common Weakness Enumeration class
CWE-6661 relationship
Common Weakness Enumeration class
Findings15
Vulnerabilities credited to this research, oldest on the left.
CVE-2026-1072220263 relationships
Integer overflow in BTF length checking.
- affectscilium/ebpf
- classified asCWE-190
CVE-2026-2550020263 relationships
Stored cross-site scripting from input that was not correctly sanitised.
- affectsRack
- classified asCWE-79
CVE-2026-3280820263 relationships
Path traversal during encrypted 7z password verification allowed a file outside the extraction directory to be deleted.
- affectspyload-ng
- classified asCWE-22
CVE-2026-3293620263 relationships
Uncontrolled resource consumption reachable from a crafted request.
- affectsCoreDNS
- classified asCWE-400
CVE-2026-3460120263 relationships
XML injection through incorrectly neutralised markup.
- affects@xmldom/xmldom
- classified asCWE-91
CVE-2026-3936020263 relationships
Missing authorization on a request path.
- affectsRustFS
- classified asCWE-862
CVE-2026-4424020263 relationships
Uncontrolled resource consumption from an unbounded allocation.
- affectsbasic-ftp
- classified asCWE-400
CVE-2026-4472420263 relationships
Command injection through unsanitised input reaching process execution.
- affectssysteminformation
- classified asCWE-78
CVE-2026-4553920263 relationships
Symlink following on an output path, exposing information outside the intended location.
- affectsmicrosoft/apm
- classified asCWE-59
CVE-2026-4578420263 relationships
Incorrect calculation of buffer size leading to an out-of-bounds write.
- affectsrust-openssl
- classified asCWE-131
CVE-2026-4852520263 relationships
Uncontrolled resource consumption when decoding a crafted token.
- affectsPyJWT
- classified asCWE-400
CVE-2026-5989620263 relationships
Race condition in request handling.
- affectshono
- classified asCWE-362
CVE-2026-6732020263 relationships
Prototype pollution reachable through request handling, leading to information exposure.
- affectsaxios
- classified asCWE-1321
CVE-2026-6893020263 relationships
Operation on a resource after expiry, with an authorization check that could be bypassed.
- affectsrussh
- classified asCWE-666
CVE-2026-7062220263 relationships
Symlink escape in Builder::append_dir_all allows a privileged process to read a file outside the intended root into the archive.
- affectstar-rs
- classified asCWE-59
Affected software15
The package or project each finding affects.
cilium/ebpf20262 relationships
Go · low severity · CWE-190
- published inGo
Rack20262 relationships
RubyGems · medium severity · CWE-79
- published inRubyGems
pyload-ng20262 relationships
PyPI · high severity · CWE-22
- published inPyPI
CoreDNS20262 relationships
Go · high severity · CWE-400
- published inGo
@xmldom/xmldom20262 relationships
npm · high severity · CWE-91
- published innpm
RustFS20262 relationships
Rust (crates.io) · medium severity · CWE-862
- published inRust (crates.io)
basic-ftp20262 relationships
npm · high severity · CWE-400
- published innpm
systeminformation20262 relationships
npm · high severity · CWE-78
- published innpm
microsoft/apm20262 relationships
Go · high severity · CWE-59
- published inGo
rust-openssl20262 relationships
Rust (crates.io) · medium severity · CWE-131
- published inRust (crates.io)
PyJWT20262 relationships
PyPI · medium severity · CWE-400
- published inPyPI
hono20262 relationships
npm · medium severity · CWE-362
- published innpm
axios20262 relationships
npm · high severity · CWE-1321
- published innpm
russh20262 relationships
Rust (crates.io) · medium severity · CWE-666
- published inRust (crates.io)
tar-rs20262 relationships
Rust (crates.io) · high severity · CWE-59
- published inRust (crates.io)
Ecosystems5
Where the affected software is distributed.
Go3 relationships
Package ecosystem
RubyGems1 relationship
Package ecosystem
PyPI2 relationships
Package ecosystem
npm5 relationships
Package ecosystem
Rust (crates.io)4 relationships
Package ecosystem
Researcher1
The origin of every relationship below.
TheSmartShadow15 relationships
Independent security research. Every node below is a published finding.
- credited onCVE-2026-10722
- credited onCVE-2026-25500
- credited onCVE-2026-32808
- credited onCVE-2026-32936
- credited onCVE-2026-34601
- credited onCVE-2026-39360
- credited onCVE-2026-44240
- credited onCVE-2026-44724
- credited onCVE-2026-45539
- credited onCVE-2026-45784
- credited onCVE-2026-48525
- credited onCVE-2026-59896
- credited onCVE-2026-67320
- credited onCVE-2026-68930
- credited onCVE-2026-70622
Elsewhere on this site
- Writing
Latest: CVE-2026-70622 - tar-rs `Builder::append_dir_all` symlink escape allows privileged out-of-root file disclosure (GitHub Gist, 2026-08-07).
- Tools
Latest: MIRSAD. MIRSAD is a local-first public content discovery and analysis system for institutional research.
- About this archive
What is published here, how it is verified, and how to report to it.
