CVE-2026-75597 · GHSA-j92p-c242-7hfx

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

Risk score: 41/100
CVSS: 5.3 v3.1
Exploit chance (30 days): 0.3%
Published: 9 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/<path:filename> route in src/pyload/webui/app/blueprints/app_blueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route (/logs, /settings, /queue, /dashboard, etc.) is…
Affected: pyload-ng (pip) <= 0.5.0b3.dev100
Fix: Upgrade pyload-ng to 0.5.0b3.dev101 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

pyload-ng: Yellow, plan it in. Api.getUserData (legacy) and Api.get_userdata are declared with @permission(Perms.ANY) and are reachable at /api/getUserData and /api/get_userdata. Because Perms.ANY == 0 and pyLoad's permission check is a bitmask AND, that gate is a no-op: every authenticated account passes, including one holding zero permission bits…

The flaws

CVE-2026-75597: PyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo (CVSS 5.3 · EPSS 0%)
GHSA-68w4-83fh-f2w8: GetUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password (CVSS 8.1)
GHSA-r44w-v6gf-x3p6: PyLoad has an authentication bypass in API key validation (check_apikey cache) (CVSS 8.1)
GHSA-9q47-3cm2-2rp8: PyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header (CVSS 6.9)

The fix

Upgrade pyload-ng: 0.5.0 or later on your release line

Who is exposed: pyload-ng (pip) >= 0.5.0b3.dev1, <= 0.5.0b3.dev101

Where it stands

Public proof of concept

Connects to

Same weakness: CWE-209 (CWE-209). 13 other warnings in 30 days

Why it is Yellow

CVSS 5.3 medium
On your watchlist: PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
pyload-ng	pip	<= 0.5.0b3.dev100	0.5.0b3.dev101

References

Original description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.

Last activity 9 Oct 2026. Patch Forecast updates every hour.