https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-42315.htmlhttps://patchthecve.com/cve/CVE-2026-42315.htmlWed, 17 Jun 2026 10:47:40 +0000HIGH 8.1: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all, allowing a user with Perms.MODIFY to specify arbitrary direhttps://patchthecve.com/cve/CVE-2026-42314.htmlhttps://patchthecve.com/cve/CVE-2026-42314.htmlWed, 17 Jun 2026 10:47:40 +0000MEDIUM 6.5: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolvehttps://patchthecve.com/cve/CVE-2026-42313.htmlhttps://patchthecve.com/cve/CVE-2026-42313.htmlWed, 17 Jun 2026 10:47:40 +0000HIGH 8.3: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The allowlist https://patchthecve.com/cve/CVE-2026-42312.htmlhttps://patchthecve.com/cve/CVE-2026-42312.htmlWed, 17 Jun 2026 10:47:40 +0000MEDIUM 6.8: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The option ("g