{"id":"CVE-2023-47890","published":"2024-01-08T00:00:00Z","modified":"2026-07-09T00:29:01Z","title":"pyLoad 0.5.0 is vulnerable to Unrestricted File Upload","vendor":null,"product":null,"tier":"tail","description":{"text":"pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.01058,"percentile":0.64456,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-h73m-pcfw-25h2","tags":[]}],"priority":{"score":19.1,"factors":[{"name":"EPSS percentile","points":12.89},{"name":"CVSS severity","points":6.16}]},"affected":[{"ecosystem":"PyPI","package":"pyload-ng","vulnerableRanges":["<0.5.0b3.dev75"],"patched":["0.5.0b3.dev75"],"from":["GHSA-h73m-pcfw-25h2","PYSEC-2026-1819"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2971","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pyload-cve-2023-0227","parents":[{"from":"CVE-2023-0227","to":"CVE-2023-47890","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/pyload/core/api/__init__.py"],"commits":["https://github.com/pyload/pyload/commit/c035714c0596b704b11af0f8a669352f128ad2d9","https://github.com/pyload/pyload/commit/695bb70cd88608dc4fee18a6a7ecb66722ebfd8f"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2023-47890","to":"CVE-2024-47821","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/pyload/core/api/__init__.py","src/pyload/webui/app/blueprints/json_blueprint.py"],"commits":["https://github.com/pyload/pyload/commit/695bb70cd88608dc4fee18a6a7ecb66722ebfd8f","https://github.com/pyload/pyload/commit/48f59567393a19263c8a0285256a7537dc9ce109"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-0435","published":"2023-01-22","fixed":"0.5.0b3.dev41","kev":false},{"cve":"CVE-2023-0488","published":"2023-01-26","fixed":"0.5.0b3.dev42","kev":false},{"cve":"CVE-2023-0509","published":"2023-01-26","fixed":"0.5.0b3.dev44","kev":false},{"cve":"CVE-2023-47890","published":"2024-01-08","fixed":"0.5.0b3.dev75","kev":false},{"cve":"CVE-2024-21644","published":"2024-01-08","fixed":"0.5.0b3.dev77","kev":false,"link":{"from":"CVE-2023-47890","to":"CVE-2024-21644","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pyload-ng","fromFixed":"0.5.0b3.dev75","toFixed":"0.5.0b3.dev77","daysApart":0}]}},{"cve":"CVE-2024-21645","published":"2024-01-08","fixed":"0.5.0b3.dev77","kev":false,"link":{"from":"CVE-2023-47890","to":"CVE-2024-21645","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pyload-ng","fromFixed":"0.5.0b3.dev75","toFixed":"0.5.0b3.dev77","daysApart":0}]}},{"cve":"CVE-2024-22416","published":"2024-01-17","fixed":"0.5.0b3.dev78","kev":false}],"package":"PyPI:pyload-ng"}}