CVE-2026-75597
Deferred Deferred - Pending Action

Information Disclosure in pyLoad WebUI

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-75597
EUVD
EUVD-2026-95911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pyload pyload < 0.5.0b3.dev101

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authentication bypass vulnerability in pyLoad versions before 0.5.0b3.dev101. The /web/<path:filename> route renders Jinja2 templates without requiring login, while other routes like /logs or /settings are protected. An exception handling typo (exc.desc instead of exc.description) leaks internal variable names in error responses. Attackers can also enumerate valid template names by checking HTTP 200 vs 500 responses.

Detection Guidance

Check if unauthenticated access to Jinja2 templates is possible by sending requests to routes like /web/logs, /web/settings, or /web/queue. Look for HTTP 200 responses or 500 errors revealing internal variable names. Use curl commands such as curl -v http://<target>/web/logs to test access.

Impact Analysis

An attacker could access sensitive information by viewing rendered templates without authentication. They might enumerate system components or internal paths through error messages. While no direct data modification or deletion is possible, information exposure could aid further attacks or reveal system configuration details.

Compliance Impact

This vulnerability could violate data protection requirements by exposing sensitive information without authentication. GDPR requires appropriate security measures to protect personal data, while HIPAA mandates access controls for protected health information. The information leak may constitute a compliance failure depending on what data is exposed.

Mitigation Strategies

Upgrade pyLoad to version 0.5.0b3.dev101 or later to apply the patch. If immediate upgrade is not possible, restrict network access to the web interface or disable unauthenticated template rendering manually.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75597. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart