CVE-2026-75597 Details
Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.
A vulnerability in pyLoad versions prior to 0.5.0b3.dev101 allows for unauthenticated access to internal Jinja2 templates through the '/web/<path:filename>' route. This route bypasses authentication, exposing sensitive templates that are normally protected. Additionally, an exception handling typo leads to the unintentional disclosure of internal variable names in HTTP 500 response bodies. An attacker can exploit this flaw to access restricted information and enumerate valid template names by analyzing response variations.
Users can upgrade to pyLoad version 0.5.0b3.dev101 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/pyload/pyload/commit/e80c940cd604e60d93e3164429d4fc4aac54468d | [email protected] | Source CodeVendor |
| https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-209 | Generation of Error Message Containing Sensitive Information | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pyLoad | <= 0.5.0b3.dev100 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |