CVE-2026-40491
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.
| CWE | CWE-22 |
| Vendor | wkentaro |
| Product | gdown |
| Published | Apr 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for wkentaro gdown
Be the first to know when new medium vulnerabilities affecting wkentaro gdown are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
wkentaro / gdown
< 5.2.2