CVE-2026-40491 json
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
published 2026-04-14 6 mo ago modified 2026-10-26 13 d ago also GHSA-76hw-p97h-883f , PYSEC-2026-2158 , EUVD-2026-23642
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.
Patch / fix
- pypi gdown 5.2.2
- wkentaro gdown 5.2.2
- gdown Debian 13 5.2.0+dfsg-2+deb13u1
- gdown Debian 14 6.0.0+dfsg-1
debian advisories DEBIAN-CVE-2026-40491
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/wkentaro/gdown/security/advisories/GHSA-76hw-p97h-883f referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gdown | <5.2.2 |
5.2.2 |
Affected products
- wkentaro gdown
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/wkentaro/gdown/commit/af569fc6ed300b7974dee66dc51e9f01b57b4dff
web, patch
-
github.com
/wkentaro/gdown/security/advisories/GHSA-76hw-p97h-883f
web, exploit, vendor-advisory, evidence
-
github.com
/wkentaro/gdown/releases/tag/v5.2.2
web, release-notes, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-40491
advisory
-
github.com
/wkentaro/gdown
package
Sources
- CVE List CVE-2026-40491
- GitHub Advisory GHSA-76hw-p97h-883f
- NVD CVE-2026-40491
- OSV PYSEC-2026-2158
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.