p PatchFirst

CVE-2026-40491

CVE-2026-40491 · gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall

This page contains facts from public vulnerability sources. Check the original advisory before updating.

gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.

CVSS 6.5 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • gdown

    Versions
    • < 5.2.2: Affected

    No fix published

  • gdown Debian:13

    Versions
    • 5.2.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 5.2.0+dfsg-2+deb13u1

    Update to 5.2.0+dfsg-2+deb13u1

  • gdown Debian:14

    Versions
    • 5.2.0+dfsg-2
    • 5.2.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 6.0.0+dfsg-1

    Update to 6.0.0+dfsg-1

  • gdown PyPI

    Versions
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.1.0
    • 2.1.1
    • 2.2.0
    • 2.3.0
    • 2.3.1
    • 3.0.0
    • 3.1.0
    • 3.10.0
    • 3.10.1
    • 3.10.2
    • 3.10.3
    • 3.11.0
    • 3.11.0rc1
    • 3.11.1
    • 3.12.0
    • 3.12.1
    • 3.12.2
    • 3.13.0
    • 3.13.1
    • 3.14.0
    • 3.15.0
    • 3.2.0
    • 3.2.1
    • 3.2.2
    • 3.2.3
    • 3.2.4
    • 3.2.5
    • 3.3.0
    • 3.3.1
    • 3.3.2
    • 3.4.0
    • 3.4.1
    • 3.4.2
    • 3.4.3
    • 3.4.4
    • 3.4.5
    • 3.4.6
    • 3.5.0
    • 3.6.0
    • 3.6.1
    • 3.6.2
    • 3.6.3
    • 3.6.4
    • 3.7.0
    • 3.7.1
    • 3.7.3
    • 3.7.4
    • 3.8.0
    • 3.8.1
    • 3.8.2
    • 3.8.3
    • 3.9.0
    • 3.9.1
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 4.1.1
    • 4.2.0
    • 4.2.1
    • 4.2.2
    • 4.3.0
    • 4.3.1
    • 4.4.0
    • 4.5.0
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5.4
    • 4.6.0
    • 4.6.1
    • 4.6.2
    • 4.6.3
    • 4.6.4
    • 4.6.5
    • 4.6.6
    • 4.7.0
    • 4.7.1
    • 4.7.2
    • 4.7.3
    • 5.0.0
    • 5.0.0rc1
    • 5.0.1
    • 5.1.0
    • 5.2.0
    • 5.2.1
    Affected ranges
    • ECOSYSTEM: < 5.2.2

    Update to 5.2.2

  • gdown Ubuntu:25.10

    Versions
    • 5.2.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gdown Ubuntu:26.10

    Versions
    • 5.2.1+dfsg-1
    • 6.0.0+dfsg-1
    • 6.1.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gdown Ubuntu:26.04:LTS

    Versions
    • 5.2.0+dfsg-2
    • 5.2.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →