CVE-2026-35592

VULNERABILITY OVERVIEW CVE-2026-35592 affects pyLoad, a free open-source Python-based download manager, in versions prior to 0.5.0b3.dev97. The vulnerability exists in the _safe_extractall() function within the UnTar.py extractor module, which improperly validates tar archive extraction paths. The flaw stems from use of os.path.commonprefix() for path traversal checks, which performs character-level rather than path-level string comparison, enabling attackers to craft malicious tar archives that extract files outside the intended directory. SEVERITY ASSESSMENT The vulnerability carries a CVSS 3.1 score of 6.5 (MEDIUM) with a network-based attack vector requiring minimal complexity and no elevated privileges, though user interaction is necessary. The impact is limited to integrity compromise with no confidentiality or availability concerns. The EPSS score of 0.00029 indicates relatively low prevalence in active exploit attempts compared to broader CVE populations. This represents an incomplete remediation of CVE-2026-32808, as the correct os.path.commonpath() function was previously committed but never applied to this particular function. EXPLOITATION STATUS The vulnerability is not currently tracked in the Known Exploited Vulnerabilities (KEV) catalog and shows no activity on relevant hot lists, indicating no confirmed active exploitation in the wild. However, the moderate CVSS score and logical path traversal mechanism suggest potential for exploitation by users with access to malicious archives. Organizations using affected pyLoad versions should prioritize upgrading to 0.5.0b3.dev97 or later to mitigate this integrity-based risk.