CVE-2026-40491

gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/wkentaro/gdown/commit/af569fc6ed300b7974dee66dc51e9f01b57b4dff	Patch
https://github.com/wkentaro/gdown/releases/tag/v5.2.2	Release Notes
https://github.com/wkentaro/gdown/security/advisories/GHSA-76hw-p97h-883f	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wkentaro:gdown:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) gdown es un descargador de archivos/carpetas públicos de Google Drive. Las versiones anteriores a la 5.2.2 son vulnerables a un ataque de salto de ruta dentro de la funcionalidad extractall. Al extraer un archivo ZIP o TAR creado con fines maliciosos, la biblioteca no logra sanear o validar los nombres de archivo de los miembros del archivo. Esto permite que los archivos se escriban fuera del directorio de destino previsto, lo que podría llevar a la sobrescritura arbitraria de archivos y a la ejecución remota de código (RCE). La versión 5.2.2 contiene una solución.

Information

Published : 2026-04-18 03:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40491

Mitre link : CVE-2026-40491

CVE.ORG link : CVE-2026-40491

JSON object : View

Products Affected

wkentaro

gdown

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-40491", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40491", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T15:49:26.274715Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "wkentaro", "product": "gdown", "versions": [{"status": "affected", "version": "< 5.2.2"}]}]}], "published": "2026-04-18T03:16:13.157", "references": [{"url": "https://github.com/wkentaro/gdown/commit/af569fc6ed300b7974dee66dc51e9f01b57b4dff", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wkentaro/gdown/releases/tag/v5.2.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wkentaro/gdown/security/advisories/GHSA-76hw-p97h-883f", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix."}, {"lang": "es", "value": "gdown es un descargador de archivos/carpetas p\u00fablicos de Google Drive. Las versiones anteriores a la 5.2.2 son vulnerables a un ataque de salto de ruta dentro de la funcionalidad extractall. Al extraer un archivo ZIP o TAR creado con fines maliciosos, la biblioteca no logra sanear o validar los nombres de archivo de los miembros del archivo. Esto permite que los archivos se escriban fuera del directorio de destino previsto, lo que podr\u00eda llevar a la sobrescritura arbitraria de archivos y a la ejecuci\u00f3n remota de c\u00f3digo (RCE). La versi\u00f3n 5.2.2 contiene una soluci\u00f3n."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wkentaro:gdown:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39302199-72EC-47E9-B5FE-38A9845F0943", "versionEndExcluding": "5.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}