File and Path Handling

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)CVE-2025-54802pyload · CVSS 9.8 · 1.4% likely

   CWE-22

2. pyLoad allows upload to arbitrary folder lead to RCECVE-2024-32880pyload · CVSS 9.1 · 1.4% likely

   CWE-434

3. pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.CVE-2023-47890Pyload · CVSS 8.8 · 1.1% likely

   CWE-22

4. pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File WriteCVE-2025-54140pyload · CVSS 7.5 · 0.8% likely

   CWE-22

5. pyLoad: Arbitrary File Write via Path Traversal in edit_package()CVE-2026-29778pyload · CVSS 7.1 · 0.6% likely

   CWE-23

6. pyLoad: Path Traversal via Package Folder Name in set_package_dataCVE-2026-42315pyload · CVSS 8.1 · 0.4% likely

   CWE-36

7. pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)CVE-2026-123815pyload · CVSS 9.4 · 0.4% likely

   CWE-22

8. pyLoad: Path Traversal via Package Folder NameCVE-2026-42314pyload · CVSS 6.5 · 0.3% likely

   CWE-22

9. pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password VerificationCVE-2026-32808pyload · CVSS 8.1 · 0.3% likely

   CWE-22

10. pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix BypassCVE-2026-35592pyload · CVSS 5.3 · 0.3% likely

    CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.