Approved changes feed: RSS · Atom
cpe:2.3:a:wkentaro:gdown:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Wkentaro (b0feea7a-670a-54b9-8a3e-b5b94dc8ec7b) |
|---|---|
| Product | Gdown (7048d2e4-3fc6-57fb-9722-137a217da4de) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wkentaro/gdown |
purl2cpe | 2026-06-01 10:16:32.978516 |
pkg:pypi/gdown |
purl2cpe | 2026-06-01 10:16:32.978517 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-40491 |
vulnerable | 2026-06-08 08:01:20.794357 |
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
MEDIUM (6.5)
gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.
Published: 2026-04-18T01:36:47.659Z
Updated: 2026-04-20T15:50:02.983Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.