gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
Résumé
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
Description d'origine
La description telle que publiée par la source (souvent en anglais).
gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-40491 gdown Corrigé dans: 5.2.0+dfsg-2+deb13u1
- Ubuntu UBUNTU-CVE-2026-40491 gdown
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com