CVE-2026-40491

CVE-2026-40491 is a path traversal vulnerability in gdown, a Google Drive file downloader library, affecting versions prior to 5.2.2. The flaw exists in the extractall functionality where maliciously crafted ZIP or TAR archives are processed without proper filename sanitization, allowing attackers to write files outside the intended destination directory and potentially achieve arbitrary file overwrite or remote code execution. This vulnerability requires user interaction (archive extraction) but no authentication or special privileges to exploit. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) with a network attack vector and low attack complexity, indicating it can be exploited remotely without complex conditions. The primary impact is on integrity, as attackers can overwrite arbitrary files on the system; there is no direct impact on confidentiality or availability. The EPSS score of 0.00047 suggests relatively low prevalence in active exploitation compared to other CVEs, though the vulnerability has been marked as active on the hotlist. Exploitation of CVE-2026-40491 is not currently listed in the Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed widespread exploitation at this time. However, the active hotlist status suggests ongoing community attention and potential reconnaissance activity. Organizations using gdown should prioritize upgrading to version 5.2.2 or later to remediate this vulnerability, particularly in environments where user-supplied archives are processed.