CVE-2026-40491

Published: Apr 18, 2026Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.

Affected (1)

Products: Wkentaro: Gdown

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wkentaro Gdown	Before 5.2.2

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

https://github.com/wkentaro/gdown/commit/af569fc6ed300b7974dee66dc51e9f01b57b4dff

Source: security-advisories@github.com

Patch

https://github.com/wkentaro/gdown/releases/tag/v5.2.2

Source: security-advisories@github.com

Release Notes

https://github.com/wkentaro/gdown/security/advisories/GHSA-76hw-p97h-883f

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.